Next.js Patches Two Critical RCE Flaws and a Denial-of-Service Bug
Summary
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws and a high-severity DoS issue. Exposure depends on configuration; some affected sharp installs may need a separate upgrade. No attacks were publicly reported as of October 15.
Key points
- The October 14 update fixes two RCE flaws rated critical by Vercel, both with CVSS scores of 9.5, and a high-severity denial-of-service flaw.
- The React Server Components flaw affects a narrow case involving multiple typed arrays and an attacker-controlled value; in Next.js, exposure is limited to version 16 apps with Cache Components enabled.
- A memory bug in librsvg, reached through sharp, can allow code execution on glibc-based Linux. SVG optimization must be enabled for the image optimizer path, though next/og can also use the library.
- Crafted requests can cause full CPU use in App Router apps with at least one Server Action; Pages Router apps and apps without Server Actions are not affected.
- Upgrade version 16 to Next.js 16.4.1 or version 15 to 15.5.28, then rebuild and redeploy. On version 15, check whether sharp is older than 0.35.5 and update it if necessary.
- If Next.js cannot be upgraded immediately, the image flaw can be mitigated by using sharp 0.35.5 or later or blocking SVG rendering in sharp. The other two flaws have no workaround.
- As of October 15, there were no public reports of exploitation; two advisories were also absent from the npm advisory feed used by npm audit.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Denial of service
- Severity
- Critical for both remote code execution flaws (CVSS 9.5 each, per Vercel); high for the denial-of-service flaw.
- Affected Versions
- Next.js 16 versions with Cache Components enabled
- Next.js 15 versions using affected sharp 0.34.x
- Next.js versions with the image-optimizer path rendering SVGs through affected librsvg
- Next.js App Router versions with at least one Server Action
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For the image-processing flaw, use sharp 0.35.5 or later.
- For the image-processing flaw, block SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }).
CVE
People
Vendors
Products
librsvgOne code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.Next.jsNext.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.Node.jsrenders images for next/og, the feature that builds social-preview images, when that feature runs on the Node.js runtime.React Server ComponentsOne code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.sharpOne code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.