Vercel Patches Critical Next.js RCE Flaws in SVG Processing and Cache Components
Vercel releases urgent updates for Next.js addressing two critical remote code execution vulnerabilities and one high-severity denial-of-service issue.
Key points
- CVE-2026-96889 allows unauthenticated remote code execution via SVG image processing on glibc-based Linux systems.
- A second critical flaw enables remote code execution in App Router applications using Cache Components with multiple typed arrays.
- A high-severity bug allows attackers to cause denial of service by exhausting CPU resources in Server Actions.
Vercel has published out-of-band security updates for the Next.js web framework to address two critical remote code execution vulnerabilities and one high-severity denial-of-service flaw. According to security disclosures from Vercel, the update was announced last week and includes fixes that were postponed from the September 2026 security release due to delays in upstream dependencies.
The most severe issue, identified as CVE-2026-96889 (GHSA-2464-fhr4-w9xw), resides within the Image Optimization API. This vulnerability is triggered during the processing of SVG images and stems from a memory-related flaw in an upstream library. On glibc-based Linux systems, this defect can lead to unauthenticated remote code execution. Vercel rates this flaw as critical because the affected feature is often exposed in production environments without requiring attacker credentials.
Scope and Affected Versions
The second critical vulnerability impacts applications utilizing the App Router with Cache Components. Attackers can achieve unauthenticated remote code execution if a use cache function returns multiple typed arrays. Vercel notes that a related advisory exists for React under identifier GHSA-xqc2-xf4c-x3h3. The company states there is no known workaround for this specific issue and urges immediate upgrades, even for applications that do not currently employ such functions.
The high-severity flaw affects App Router applications that include at least one Server Action. Crafted requests can drive excessive CPU usage, blocking other requests within the same process and resulting in denial of service. This issue is linked to React advisory GHSA-h3gv-c5rc-p453. Applications using the Pages Router or those without Server Actions are not vulnerable to this specific denial-of-service vector.
Mitigation and Patching
Patches are available for Next.js version 16.4.1, which is the Active LTS release, and version 15.5.28, the Maintenance LTS release. Vercel urges all users to apply these updates promptly. For the SVG processing vulnerability, teams can ensure the sharp library version is 0.35.5 or later as a mitigation step. Upgrading Next.js to the patched versions automatically supplies the fixed sharp version through package managers.
Users should verify their base images, as Alpine and other musl-based environments are not explicitly named as affected in the advisory text. However, assuming safety without confirmation is not recommended. That suggests teams must validate their specific deployment configurations rather than relying on general assumptions about library safety.
What should you do?
Administrators should immediately audit their Next.js installations to determine if they are running vulnerable versions. If the application uses the App Router with Cache Components or Server Actions, the risk of exploitation is elevated. Teams should prioritize upgrading to version 16.4.1 or 15.5.28 to resolve all three identified vulnerabilities.
What to do and how to stay safe: Next.js
- Check your current Next.js version against the vulnerable ranges and upgrade to v16.4.1 or v15.5.28 immediately.
- Verify that the sharp library dependency is version 0.35.5 or higher if you cannot upgrade Next.js instantly.
- Review your application architecture to confirm if you use App Router Cache Components or Server Actions to assess exposure.
- Confirm whether your deployment environment uses glibc-based Linux, as the critical SVG flaw specifically targets these systems.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Next.js versions are affected by the critical RCE flaws?
Versions prior to Next.js v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS) are vulnerable to the critical remote code execution flaws.
Is there a workaround for the Cache Component vulnerability?
No, Vercel states there is no known workaround for the second critical flaw involving Cache Components and advises immediate upgrading.
Are Alpine Linux environments affected by the SVG processing vulnerability?
The advisory does not name Alpine or other musl-based environments as affected, but teams should confirm their base images rather than assume safety.
