Next.js: two critical remote code execution bugs
Two critical bugs let an attacker run code on a Next.js server: one in image optimization of SVGs, one in use cache. Fixed in 15.5.28 and 16.4.1.
What happened
On 14 October 2026, Next.js shipped an out-of-band security release fixing two critical remote code execution bugs and one denial-of-service bug.
Image optimization (GHSA-2464-fhr4-w9xw): an SVG passed to the image optimizer can run code on the server, through librsvg in sharp. A public proof of concept has been reported.
use cache (GHSA-673q-mjm6-r5xr): Next.js 16 apps using Cache Components can be exploited when a use cache function returns typed arrays.
Server Actions (GHSA-p3m5-59mp-jv5r, CVE-2026-94482): App Router apps with a Server Action can be knocked offline, versions 13 to 16.
Who is affected
- Next.js apps below 15.5.28 (15.x) or 16.4.1 (16.x). That includes most v0 apps and any other app built on Next.js.
How to check
- Run npm list next in your project to see your version.
- Or run npx shippable-dev scan localhost:3000 in your project folder: it reads your lockfile and flags all three advisories.
How to recover
- Upgrade: npm install next@16.4.1 (or next@15.5.28 on 15.x), commit the lockfile and redeploy.
- If you can't upgrade today, make sure the sharp version Next.js uses is 0.35.5 or later, which closes the SVG bug.
- If your app was on an affected version and public, check server logs for odd image-optimizer requests and rotate the secrets the server could read.
Check your app
Free and read-only. Before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.