Next.js fixes two critical RCE flaws; the sharp workaround covers only one

Three issues, one release, different exposure

Cover: AI-generated editorial illustration for P.K. Sharma. Conceptual artwork, not a screenshot or evidence of an observed attack.

Next.js published its out-of-band security update on 14 October 2026. The supported patched releases are 16.4.1 and 15.5.28. This is coverage of yesterday’s release, checked on 15 October. Vendor announcement.

The useful operational question is whether each vulnerable feature exists in the deployed application, and whether the corrected dependency is actually running. A package change in a developer checkout does not establish either fact. The following table separates the three paths so an image-only workaround is not mistaken for a complete patch.

Vendor prerequisites and fixes. The sharp workaround applies only to the image issue.

Issue	Published prerequisite	Fix / workaround
Critical RCE, GHSA-673q-mjm6-r5xr	App Router, Cache Components and a use cache function returning multiple typed arrays	Next.js 16.4.1. No known workaround.
Critical RCE, GHSA-2464-fhr4-w9xw / CVE-2026-96889	Image optimisation using SVG on glibc-based Linux	Next.js 16.4.1 or 15.5.28; sharp 0.35.5+ is the stated workaround.
High DoS, GHSA-p3m5-59mp-jv5r	App Router with at least one Server Action	Next.js 16.4.1 or 15.5.28. Upgrade required.

Table sources: cache advisory, image advisory and Server Actions advisory.

Feature image: Original typographic editorial cover; not a screenshot or depiction of an observed attack. Credit: P.K. Sharma; facts: Next.js / Vercel.

Cache Components: do not reduce the warning to a code search

The cache advisory lists Next.js 16.0.0 through 16.4.0 as affected and 16.4.1 as patched. It gives a CVSS 4.0 score of 9.5 and describes unauthenticated remote code execution. The stated condition involves multiple typed arrays returned from a cached function. Cache Components advisory.

A search for that pattern can support triage, but it is a weaker closure test than confirming the patched build. Application code can be wrapped by libraries, generated during a build or changed by another team. The vendor explicitly recommends upgrading even without similar functions. Record the search result as an exposure observation, not an exemption from the update.

The image fix includes a dependency check

The image advisory gives sharp 0.35.5 or later as its workaround and says patched Next.js releases cause package managers to provide a fixed sharp version. Its affected platform condition is glibc-based Linux, with SVG in the image-optimisation path. This is not a claim that every uploaded SVG or every operating system is vulnerable. Image optimisation advisory.

For a deployment review, inspect the resolved dependency tree and the artefact deployed to production. An old lockfile, a cached image layer or a running replica from an earlier release can preserve different bytes from those expected. Those are general deployment failure modes; this newsroom has not observed them in a victim of these flaws.

The third flaw blocks request processing

The Server Actions issue can consume CPU and prevent further requests being handled in the same process. Its advisory lists affected 13.0.0–15.5.27 and 16.0.0–16.4.0 ranges, with fixed releases 15.5.28 and 16.4.1. Pages Router applications, and applications without Server Actions, are outside this particular condition. Denial-of-service advisory.

That exclusion applies to this flaw only. It says nothing about an application’s image configuration or other dependencies. Rate and availability monitoring can show that a service is unhealthy, but neither is proof that the corrected request handling has been deployed.

Close the change against running instances

Assessment: the strongest completion evidence is a known patched artefact running across the service, with its important workflows still working. Keep each exposure check attached to its own advisory.