Next.js ships critical fixes for two RCE flaws

Next.js users have been told to patch immediately after the framework’s maintainers disclosed two critical unauthenticated remote-code-execution flaws, plus a high-severity denial-of-service bug. The fixes are available in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance LTS releases.¹

The first critical issue affects applications using App Router with Cache Components. Under a narrow set of conditions, a `use cache` function returning multiple typed arrays can be abused to run code without authentication. Vercel says there is no known workaround for affected applications, so upgrading is the required fix even if a project does not appear to use that exact pattern.¹²

The second RCE is in the image-optimisation path when SVG files are processed through `sharp`. Next.js reaches the vulnerable upstream `librsvg` library through that package. The exposure is relevant to glibc-based Linux deployments, particularly where SVG handling is enabled with `dangerouslyAllowSVG`, and it can also affect `next/og` image generation on the Node.js runtime.¹

The update also addresses a denial-of-service issue in App Router applications that use at least one Server Action. Crafted requests can drive a server process to full CPU usage, preventing it from handling other requests. Apps using the Pages Router, or apps without Server Actions, are not affected by this particular flaw.¹

What developers should do

Upgrade to Next.js 16.4.1 if the project runs version 16, or 15.5.28 if it runs version 15. Vercel says the newer Next.js versions pull in a fixed `sharp` release automatically on version 16. Version 15 can retain an older `sharp` package after the framework upgrade, so teams should check the dependency tree with `npm ls sharp` and update it to 0.35.5 or later if necessary.¹³

If an immediate framework upgrade is impossible, the SVG issue has a temporary mitigation: use `sharp` 0.35.5 or later, or block SVG loading with the mitigation described in the upstream advisory. That does not address the `use cache` or Server Actions vulnerabilities, which have no equivalent workaround.²⁴

The disclosure arrives after several recent security problems involving image processing in the Next.js ecosystem. That pattern is a reminder that a framework update is not enough on its own: deployment teams should inspect transitive packages, rebuild and redeploy, and verify that the running production dependency tree matches the patched lockfile.

Our opinion

This is an upgrade-now release, not a wait-for-the-next-maintenance-window patch. The `use cache` flaw is narrow, but the image-processing issue sits in a path that can be exposed by configuration and server-side image features. Checking the installed `sharp` version separately is especially important for Next.js 15 users, because a successful framework upgrade can still leave a vulnerable transitive dependency in place.