- Vercel released Next.js 16.4.1 and 15.5.28 on October 14 to fix two critical remote code-execution flaws and one denial-of-service flaw.
- As of October 15, The Hacker News reports, two of the advisories had no CVE and were missing from the feed behind npm audit, so scanners may stay silent.
- Upgrade, then run npm ls sharp on the deployed build, because version 15 upgrades can leave an affected image library in place.
A quiet scanner is not a patched system
Many security programs rest on one comfortable habit. Run the scanner. If it reports nothing, move on. This week's Next.js update shows where that habit can fail.
Vercel, which develops Next.js, released an out-of-band update on October 14. It fixes two flaws that it rates critical. Each allows unauthenticated remote code execution, meaning an outsider could run code on your server without logging in.
The Hacker News checked the advisory records the next day. Two of the three advisories, the cached-function flaw and the Server Actions flaw, had no CVE number. Neither appeared in the feed that npm audit reads. Dependency scanners may therefore say nothing about those two.
The image flaw is different. It does appear through sharp's own advisory, so the silent gap applies only to the use cache and Server Actions flaws. The lesson here is that your tools can only warn you about what has been catalogued.
What Vercel fixed
The fixes ship in Next.js 16.4.1, the Active LTS release, and 15.5.28, the Maintenance LTS release. Vercel says two of the fixes were held back from its September security release because upstream dependencies were late.
There are three issues. The first is a code-execution flaw in apps that use the App Router with Cache Components, when a "use cache" function returns multiple typed arrays. The second is a code-execution flaw in the Image Optimization API when it handles SVG files. The third is a denial-of-service flaw, rated high severity, in App Router apps that use Server Actions. The Hacker News reports a CVSS score of 9.5 for each of the two code-execution flaws.
How the flaws work
The first bug comes from React's server components, where parts of a page are built on the server instead of in the browser. Typed arrays are blocks of raw binary data. React's advisory limits the trigger to "extremely rare cases", as The Hacker News quotes it: a response that carries several typed arrays plus an attacker-controlled value. In Next.js, that means a "use cache" function returning more than one typed array. Vercel says there is no known workaround. It still tells teams to upgrade even if their code has no such function.
The second bug sits in librsvg, a library that turns SVG vector graphics into pictures. It mishandles memory, and on Linux systems built on glibc that can let an attacker run code. Next.js reaches librsvg through sharp, its image-processing package. Next.js does not optimize SVG files by default. A team must switch on a setting named dangerouslyAllowSVG first. The Hacker News notes a second route: next/og, which makes link-preview images, uses the same library when it runs on Node.js.
The third flaw is a way to overload a server. Specially built requests can make a single process spend all its processor time, so it stops answering anyone else. An app is exposed only if it uses the App Router and has declared a Server Action. Teams on the Pages Router are clear of this one, and so is any app with no Server Actions.
Upgrading may not finish the job
Vercel's advisory says that upgrading Next.js pulls in a fixed copy of sharp. For version 16, The Hacker News finds that this holds: the 16.4.1 release sets 0.35.5 as its minimum. Version 15 is different. Release 15.5.28 still permits the affected sharp 0.34.x, and upgrading on top of an existing install can keep the old copy.
So a team on version 15 can upgrade, see a successful build and still run the vulnerable library. The check is a single command, npm ls sharp. Teams that cannot upgrade yet have a stopgap for the image bug only: move sharp to 0.35.5 or newer, or switch off SVG loading inside sharp. The other two flaws have no workaround.
Who carries the risk
The person most exposed is the engineer who tells leadership the audit is clean. The report may be accurate and still incomplete. The Hacker News reports that Netlify sees limited impact, because the image-optimizer path at issue is not part of how its platform runs. Netlify still recommends the upgrade. Exposure differs by host, which is one more reason to ask rather than assume.
Scale matters too. In a WebPulse scan of the Tranco top-10,000 domains in September 2026, 7,064 sites responded and a platform was detected on 2,491. Next.js accounted for 791 of those, or 31.8%. That is a share of detected sites in one sample, not of the web. It is also not a count of vulnerable sites, because the first flaw needs version 16 with Cache Components enabled.
Three image flaws, three different causes
The Hacker News counts three code-execution flaws in Next.js image handling since August. They do not share one cause. In August, the bug was in libheif, reached through sharp. This month it is in librsvg, again reached through sharp. In September it was in next/og, where attacker-controlled text could change the SVG the feature generated.
According to The Hacker News, this month's image bug lives in a library, not in image code the Next.js team altered. The two sharp cases carry a dependency lesson: a framework's exposure includes the libraries it reaches through other packages. The September case adds a second one, that the framework's own features can fail as well. An inventory that lists Next.js but not sharp misses part of the picture.
Questions to put to your team
Ask which Next.js version each production app runs, and whether any uses Cache Components or Server Actions. Ask for the output of npm ls sharp from the deployed build, not a developer's laptop. Ask whether SVG optimization is enabled, and whether apps run on glibc-based Linux.
Ask how the team learns about flaws that have no CVE yet. Vendor advisories and release notes need an owner, just as scanners do. A green dashboard tells you what is known. It does not tell you what is true.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Vercel (Next.js).
