Next.js Releases Out-of-Band Patch for Critical RCE and DoS Vulnerabilities

Emergency Security Update Released

Next.js issued an out-of-band security update on October 14 to address significant vulnerabilities. The update includes fixes for two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) vulnerability. These patches are available in Next.js versions 16.4.1 and 15.5.28, which are the current Active and Maintenance long-term support (LTS) releases.

Critical RCE Flaws Identified

One critical RCE flaw affects React Server Components, specifically within the `use cache` function when it returns multiple typed arrays. This vulnerability impacts Next.js 16 applications that have Cache Components enabled. The second critical RCE flaw is a memory bug in librsvg, an open-source library used by Next.js via the `sharp` package for SVG image handling. This flaw allows code execution on glibc-based Linux systems, particularly when the `dangerouslyAllowSVG` setting is enabled or when `next/og` generates social-preview images on the Node.js runtime. Vercel, the developer of Next.js, assigned a CVSS score of 9.5 to both RCE vulnerabilities.

Denial-of-Service Vulnerability

A high-severity denial-of-service vulnerability was also patched. This issue affects App Router applications that define at least one Server Action. Maliciously crafted requests can cause a server process to consume full CPU resources, preventing it from handling other requests. Applications using the Pages Router or those without Server Actions are not affected by this specific DoS flaw.

Affected Versions and Remediation

The RCE flaw in React Server Components affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in versions 19.0.0 through 19.3.0. The librsvg flaw impacts Next.js installations that process SVG images. All users running Next.js 16 should upgrade to 16.4.1, and those on Next.js 15 should upgrade to 15.5.28. Vercel recommends upgrading even if an application does not explicitly use the affected functions or features.