Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Key Points:

• Next.js has released an out-of-band security update addressing two critical remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw.
• The vulnerabilities affect Next.js versions 16.4.1 and 15.5.28, with critical CVSS scores of 9.5, potentially allowing unauthenticated attackers to execute arbitrary code or cause service disruptions.
• Immediate upgrade to the latest versions is recommended; for those unable to upgrade, ensure the sharp package is updated to version 0.35.5 or later, or block SVG rendering as a temporary measure.

Technical Details: The identified flaws include a memory bug in librsvg (CVE-2026-96889) and issues in React Server Components that could lead to RCE under specific conditions. The vulnerabilities are particularly concerning for applications running on glibc-based Linux systems.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned:

• CVE-2026-96889