Next.js security update: check your site is on 16.4.1 or 15.5.28

Got a website or web app made with Next.js? It needs an update. On 14 October 2026 the Next.js team put out an out-of-cycle security release. Two of the flaws it fixes are critical: either one could let someone with no login run their own commands on the server that hosts the site. A third lets an attacker overload a site until it stops responding.

Nothing to do with PHP2Shell, the PHP flaw now being used in attacks. This is a separate problem in separate software, and its fix came out a week before PHP's.

What's been fixed

Next.js is what a lot of custom-built websites and web apps are made with these days. WordPress sites don't use it. The update fixes three problems.

• Images. Next.js can resize and optimise images on the fly. A specially crafted SVG image could trigger a memory bug in librsvg, an image library Next.js reaches through another library called sharp, and run code on the server. It affects sites running on the most common kinds of Linux server.
• Cached functions. A newer Next.js feature called use cache could also be tricked into running an attacker's code, with no login needed.
• Server Actions. Crafted requests could tie up the server's processor so it stops answering anyone else.

Vercel, the company behind Next.js, rates both code-running flaws 9.5 out of 10.

Has anyone been attacked?

Not that anyone has reported. None of them is on CISA's list of vulnerabilities known to be used in real attacks, as of its 26 October update.

NHS England's cyber team says a proof-of-concept attack has been reported for the image flaw, and it expects that flaw to be exploited. PHP2Shell went the same way: test exploits first, real attacks a few days later. Better to be ahead of it.

Does it affect you?

If your site was built with Next.js and hasn't been updated since 14 October, probably yes. The affected versions:

• the image flaw: Next.js 10.0.0 to 15.5.27, and 16.0.0 to 16.4.0
• the use cache flaw: 16.0.0 to 16.4.0
• the Server Actions flaw: 13.0.0 to 15.5.27, and 16.0.0 to 16.4.0

The fixed versions are 16.4.1 and 15.5.28, or anything later.

Not sure what your site's built with? Your developer will know. Or open your site, view the page source and look for /_next/ in it.

Hosted on Vercel or Netlify? You still need the update. Your host doesn't change the code your site was built with. The fix only goes live when the site is rebuilt on the new version and redeployed.

On your own server? Then it's down to you or your developer. Put it near the top of the list.

What to ask your developer (copy and paste)

Subject: Next.js security update of 14 October 2026

Hi,

Please can you confirm the following for [your web address]:

1. Which version of Next.js is the site on? Has it been updated to 16.4.1 or 15.5.28, or later?
2. Has the site been rebuilt and redeployed since then?
3. If it's on version 15, is the image library sharp on 0.35.5 or later?
4. Are any old preview or test copies of the site still online on the old version? If so, can they be removed?

Thanks,

[your name]

For developers

• GHSA-673q-mjm6-r5xr, unauthenticated RCE in use cache functions returning multiple typed arrays (App Router with Cache Components). next 16.0.0 to 16.4.0, fixed in 16.4.1. CVSS 4.0 9.5. No workaround, and Vercel says to upgrade even if you have no such functions. The upstream React advisory, GHSA-xqc2-xf4c-x3h3, covers react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1. No CVE yet.
• CVE-2026-96889 / GHSA-2464-fhr4-w9xw, RCE in the Image Optimization API through a librsvg use-after-free (nested XIncludes with duplicate entity declarations), on glibc-based Linux only. next 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, fixed in 15.5.28 and 16.4.1. Vercel rates it CVSS 4.0 9.5; the librsvg CVE itself carries 7.8 (CVSS 3.1). Workaround: make sure sharp is 0.35.5 or later.
• CVE-2026-94482 / GHSA-p3m5-59mp-jv5r, CPU-exhaustion denial of service in App Router apps with at least one Server Action. next 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0, fixed in 15.5.28 and 16.4.1. CVSS 4.0 8.2. Pages Router apps, and apps with no Server Actions, aren't affected.
• The version 15 catch. next@15.5.28 still declares sharp as ^0.34.3 || ^0.35.5, so an existing lockfile can keep a vulnerable 0.34.x after you bump next. Run npm ls sharp and make sure every copy is 0.35.5 or later. next@16.4.1 requires ^0.35.5, so on 16.x the upgrade pulls the fixed one in.
• Your audit may have missed it. These only reached GitHub's public advisory database, which npm audit reads, on 22 October. An audit run between 14 and 22 October could have come back clean on a vulnerable app.
• Since then: 16.4.2 (15/10) and 16.4.3 (23/10) are bug-fix backports with no further security fixes, and no new Next.js advisories have appeared since 14 October (checked 27 October). Going straight to 16.4.3 is fine.
• Old deployments. Hosting platforms keep previous deployments reachable at their own URLs, still running the old build. Delete or protect the ones you no longer need.

Not sure what your site runs on?

Send me your web address and I'll tell you what it's built with and whether this update applies to it.

Official advice

• Next.js: Security Update for Upstream Vulnerabilities, 14 October 2026
• Next.js advisory GHSA-2464-fhr4-w9xw (image optimisation)
• Next.js advisory GHSA-673q-mjm6-r5xr (use cache)
• Next.js advisory GHSA-p3m5-59mp-jv5r (Server Actions)
• sharp advisory GHSA-wq5f-xc86-pv6w
• NHS England Digital cyber alert CC-4873