Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Vercel pushed an emergency update for Next.js on October 14, fixing two critical remote-code-execution bugs and one high-severity denial-of-service issue. The first flaw, scored 9.5, affects App Router apps using Cache Components where a use cache function returns more than one typed array, tracing back to a React Server Components bug shared by react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The second, CVE-2026-96889, lives in the librsvg library pulled in via the sharp package, letting attackers trigger code execution through malicious SVG images on glibc-based Linux systems when image optimization is enabled. A third, lower-severity bug lets crafted requests to Server Actions exhaust a server process's CPU. Fixes landed in Next.js 16.4.1 and 15.5.28; users should also verify sharp is upgraded to 0.35.5 or later, since the two non-image flaws currently lack CVE tracking and may not be flagged by standard dependency scanners.