Next.js Patches Critical Unauthenticated RCE Flaws in Caching and SVG Handling
Vercel released urgent security updates for Next.js to fix two critical remote code execution vulnerabilities and one high-severity denial-of-service issue.
Key points
- Two critical flaws allow unauthenticated remote code execution via React Server Components and librsvg.
- Fixes are available in Next.js versions 16.4.1 and 15.5.28, the current LTS releases.
- A third high-severity flaw causes denial-of-service in App Router apps with Server Actions.
Vercel released an out-of-band security update for Next.js on October 14 to address two critical remote code execution vulnerabilities and one high-severity denial-of-service flaw. The patches resolve issues that could allow attackers to execute arbitrary code on servers running affected versions of the popular React framework.
The security update applies to Next.js versions 16.4.1 and 15.5.28, which are the current Active and Maintenance long-term support releases. Vercel rated both code-execution flaws as critical, assigning each a CVSS score of 9.5. The denial-of-service issue is rated high severity. This follows earlier reporting by Threat Times on October 15 regarding the urgency of these updates.
Context and Background
The first critical vulnerability resides in React Server Components, a feature that executes user-interface components on the server. According to The Hacker News, the flaw affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. It impacts react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages in versions 19.0.0 through 19.3.0.
In a Next.js application, the trigger occurs when a use cache function returns more than one typed array. This means only version 16 apps that enable Cache Components are exposed to this specific vector. Vercel advises developers to upgrade to the patched versions even if their applications do not currently use such functions, ensuring comprehensive protection against potential exploitation.
The second critical flaw is a memory bug in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. Code execution is possible when Next.js runs on glibc-based Linux systems. By default, Next.js does not optimize SVG files, but serving them through the image optimizer requires enabling the dangerouslyAllowSVG setting. The same library also renders images for next/og social-preview features on the Node.js runtime.
Who Is Affected
Developers using Next.js versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected by the caching vulnerability. Apps that pass attacker-supplied SVG files to sharp on glibc-based Linux are vulnerable to the second code-execution flaw across the same version ranges. The third issue affects App Router apps that define at least one Server Action, where crafted requests can push a server process to full CPU use.
The denial-of-service flaw stops the affected server process from handling other requests, potentially disrupting service availability. This issue is distinct from the code-execution vulnerabilities but poses a significant risk to application stability. All three issues are resolved in the newly released LTS versions, providing a clear path for remediation for users of the framework.
What should you do?
Developers should immediately verify their Next.js version and upgrade to 16.4.1 or 15.5.28 to mitigate these risks. Applications using sharp should ensure they are running version 0.35.5 or later in conjunction with Next.js 15.5.28. Monitoring server logs for unusual CPU spikes or unexpected process terminations can help detect potential exploitation attempts before they cause significant downtime.
What to do and how to stay safe: Next.js
- Audit your Next.js version and upgrade to the latest LTS release (16.4.1 or 15.5.28) immediately.
- Review your application configuration to disable dangerouslyAllowSVG if SVG optimization is not strictly required.
- Monitor server processes for abnormal CPU usage spikes that could indicate a denial-of-service attack.
- Ensure the sharp package is updated to version 0.35.5 or later if using Next.js 15.5.28.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Next.js versions contain the fixes for these vulnerabilities?
The fixes are included in Next.js versions 16.4.1 and 15.5.28, which are the current Active and Maintenance LTS releases.
Does the SVG vulnerability affect all Next.js installations?
No, it primarily affects apps that pass attacker-supplied SVG files to sharp on glibc-based Linux or use next/og on the Node.js runtime.
Is there a CVSS score for these vulnerabilities?
Yes, Vercel rated both code-execution flaws as critical with a CVSS score of 9.5, while the denial-of-service flaw is high severity.
