If you patched Next.js in September and figured you were done for the season, check again. The October 14 update is actually the second half of that September wave: Vercel says two of the fixes were postponed because an upstream dependency wasn't ready. Now they have landed all at once — two remote code execution flaws at CVSS 9.5 and a denial-of-service at 8.2 — and both RCEs work without any authentication. This is not a "when you get around to it" release.

What is actually broken

The cache hole (GHSA-673q-mjm6-r5xr). If your App Router app uses Cache Components and a use cache function returns multiple typed arrays, an attacker can turn that into unauthenticated remote code execution. It hits Next.js 16.0.0 through 16.4.0. The part worth reading twice: Vercel states there is no known workaround, and tells you to upgrade immediately even if your app has no such functions. Don't audit first. Patch first.

The image hole (CVE-2026-96889). This one has the widest reach of any Next.js disclosure this year: versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The bug is a use-after-free in librsvg, the library bundled inside sharp, and Next.js exposes it remotely through the Image Optimization API when an attacker-controlled SVG shows up. On glibc-based Linux — which describes the default Debian/Ubuntu Docker image most people deploy — that is full code execution. Your app doesn't need Cache Components or anything exotic for this one; it just needs image optimization on a standard Linux host.

The noisy one (GHSA-p3m5-59mp-jv5r). Crafted requests against any App Router app with at least one Server Action can pin a CPU and starve the process. CVSS 8.2, less glamorous than an RCE, but it affects the broad 13.x–16.x range and it is trivially cheap to fire. Pages Router apps without Server Actions are the only ones that get to sit this one out.

The playbook

1. Find every Next.js you run. Not just the flagship app — the marketing site, the internal tool, the thing from a tutorial that somehow ended up in production.

BASH
npm ls next

Anything below 15.5.28 on the 15.x line or below 16.4.1 on the 16.x line is in scope. Anything on 16.0.0–16.4.0 with Cache Components enabled goes to the front of the queue, because that flaw has no workaround at all.

2. Interrogate your image pipeline.

BASH
npm ls sharp

If sharp resolves below 0.35.5, the SVG hole is open regardless of what your framework version claims. Pinning sharp to 0.35.5 or later is the one workaround Vercel offers — treat it as a tourniquet while you schedule the real upgrade, not as the fix, because it leaves the other two flaws untouched.

3. Upgrade to the patched line.

BASH
npm install [email protected]   # if you are on 16.x
npm install [email protected]  # if you are on 15.x

Upgrading Next.js makes your package manager pull the fixed sharp automatically, which closes the image hole without a separate step.

4. Verify like an operator, not an optimist. Rebuild, redeploy, restart the process — a patched node_modules sitting next to a still-running old process protects nothing. Then re-run npm ls next sharp against the deployed artifact and confirm both numbers moved. If you run multiple services off one repo, confirm each one actually picked up the new lockfile.

Who drops everything

Three groups should treat this as a today-job: anyone on Next.js 16 with Cache Components (unauthenticated RCE, no workaround), anyone serving optimized images on glibc Linux (the widest blast radius of the three), and anyone whose Server Actions face the public internet (a DoS that costs the attacker almost nothing). Everyone else patches this week, because exploit write-ups for 9.5s do not stay private for long.

September was the warning shot. October is the bill coming due — pay it while it's still just a version bump.

Sources:

  • Next.js Security Update for Upstream Vulnerabilities — https://nextjs.org/blog/nextjs-security-update-october-14-2026
  • GHSA-673q-mjm6-r5xr — https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
  • CVE-2026-96889 / GHSA-2464-fhr4-w9xw — https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
  • GHSA-p3m5-59mp-jv5r — https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r