Next.js Issues Emergency Patch for Two Critical Remote Code Execution Flaws

Next.js, the popular web framework developed by Vercel, has released an out-of-band security update fixing two critical flaws that could let an unauthenticated attacker run code remotely. Each flaw is rated 9.5 on the CVSS scale. A third, high-severity flaw could allow a denial-of-service attack. The fixes are in Next.js 16.4.1 and 15.5.28.

The first code-execution flaw sits in React Server Components. It affects apps on version 16 that enable Cache Components and use a "use cache" function returning more than one typed array. The second is a memory bug in librsvg, an SVG image library that Next.js uses through the sharp package. Code execution is possible on glibc-based Linux. Exposure requires SVG handling through the image optimizer, which needs the dangerouslyAllowSVG setting turned on, or the next/og social-preview feature running on the Node.js runtime.

The denial-of-service issue affects App Router apps with at least one Server Action, where crafted requests can push a server process to full CPU use. Pages Router apps and apps without Server Actions are not affected. Netlify said its platform does not run the image-optimizer code path and sees limited impact, but still recommends upgrading. Vercel advises upgrading even if your app has no vulnerable function.