Next.js 16.4.1 fixes two critical flaws that need no login to exploit

Next.js 16.4.1 fixes two critical flaws that need no login to exploit

14 October 2026: Vercel has released Next.js 16.4.1 and 15.5.28 to fix two critical remote code execution flaws that an attacker can trigger without signing in. One, CVE-2026-96889, sits in the Image Optimization API and affects every release from Next.js 10.0.0; the other is in functions marked with the use cache directive and affects the whole 16.x line up to 16.4.0, with no workaround. Vercel published both advisories on GitHub on the afternoon of 14 October, together with a high-severity denial-of-service fix, and tells users to upgrade at once.

Not yet independently verified. Vercel gives no CVSS scores and no CVE number for the use cache flaw, and reports no exploitation in the advisories. We will add both when Vercel publishes them. We will update this when it can be confirmed, and remove this note.

How the image flaw is reached

The Image Optimization API is the endpoint behind the next/image component, which resizes and converts images on the server. Vercel says a memory flaw in an upstream image library it relies on can lead to code execution when the API processes SVG files and the application runs on a Linux distribution built on glibc, which covers most standard Debian and Ubuntu container images.

The vulnerable ranges are 10.0.0 to 15.5.27, fixed in 15.5.28, and every 16.x release after 16.0.0 up to 16.4.0, fixed in 16.4.1. Vercel names a workaround for teams that cannot move Next.js straight away: make sure the sharp package that Next.js uses is at version 0.35.5 or later. A fresh install pulls a fixed sharp automatically, and upgrading Next.js makes the package manager do the same.

The use cache flaw has no workaround

The second advisory, GHSA-673q-mjm6-r5xr, concerns applications on the App Router with Cache Components, where a function marked use cache returns several typed arrays. Vercel rates it critical, lists 16.0.0 to 16.4.0 as affected and 16.4.1 as fixed, and states that there is no known workaround. It asks teams to upgrade even if they believe none of their functions match, which is the safer reading for anyone unsure what a dependency does inside a cached function.

The 15.x line is not listed as affected by this one, because the use cache directive arrived with 16.

A denial-of-service fix in the same release

The third advisory, GHSA-p3m5-59mp-jv5r, is a high-severity denial of service in the App Router through Server Actions. It reaches further back, to 13.0.0, and is fixed in the same two releases. It is the fourth batch of Next.js security fixes in under a month: on 30 September Vercel published a server-side request forgery flaw in image optimisation and several cache leakage issues fixed in the 16.3 line.

What a lockfile check should show

For a team running Next.js on its own servers, the check is two lines in the lockfile: next at 16.4.1 or 15.5.28, and sharp at 0.35.5 or later. Applications on releases older than 15.5 have no patched version in their line and need a larger upgrade. Vercel's advisories do not say whether sites hosted on its own platform needed any action, and neither reports exploitation so far.

We list Vercel and its hosting product; our web hosting software category is small, while our web hosting company category lists 200 firms, many of which run Next.js sites for clients.

Related on TrustList:

• Cohere plans to buy AISLE, the AI bug hunter behind 500 CVEs
• Drupal fixes critical Field UI flaw with a no-login path via add-ons
• Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6

Sources

• Vercel, GitHub security advisory GHSA-2464-fhr4-w9xw (CVE-2026-96889): Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used, 14 October 2026
• Vercel, GitHub security advisory GHSA-673q-mjm6-r5xr: Unauthenticated Remote Code Execution in use cache functions returning typed arrays, 14 October 2026
• Vercel, GitHub security advisory GHSA-p3m5-59mp-jv5r: Denial of Service in App Router using Server Actions, 14 October 2026
• The Hacker News: Next.js ships out-of-band patch for two critical flaws, 15 October 2026