Critical Next.js Flaw Allows Remote Code Execution via SVG Images

The Next.js team released an out-of-band security update on October 14, 2026 that fixes three vulnerabilities. The most serious, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), lives in the Image Optimization API and lets an unauthenticated attacker run code on the server when SVG files are processed. It carries a CVSS 4.0 score of 9.5 and is rated Critical. The root cause is a use-after-free bug in librsvg, the library sharp relies on to render SVGs. It is triggered by an SVG document with nested XIncludes and duplicate entity declarations. According to Vercel, code execution is only possible when Next.js runs on glibc-based Linux, such as Debian or Ubuntu containers. Versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected; 15.5.28 and 16.4.1 contain the fix. The same release patches two more issues. GHSA-673q-mjm6-r5xr, also rated 9.5, is a remote code execution flaw in App Router apps using Cache Components with a `use cache` function that returns multiple typed arrays; it affects only 16.0.0 through 16.4.0. GHSA-p3m5-59mp-jv5r, rated 8.2, lets crafted requests to Server Actions tie up the CPU and block further requests, causing a denial of service. The main fix is to upgrade to Next.js 16.4.1 or 15.5.28, then rebuild and redeploy. For the SVG flaw, Vercel says to make sure sharp is at version 0.35.5 or later. Teams on the 15.x line should check carefully: if the lockfile still pins sharp 0.34, upgrading Next.js alone may not move it, so verify with `npm ls next sharp`. There is no workaround for the other two flaws other than upgrading.