BREAKING: Next.js October 2026 security update fixes two unauthenticated RCEs. Check sharp too (CVE-2026-96889)

If you self-host a Next.js app on Linux, a request from someone with no account can, in the worst case, run code on your server. Vercel shipped Next.js 16.4.1 and 15.5.28 on 2026-10-14 (npm publish around 1:36 to 1:44 PM ET) with three advisories: two critical remote code execution bugs (CVSS 4.0 score 9.5) and one high denial of service. React shipped 19.0.9, 19.1.10, 19.2.9 and 19.3.1 about an hour earlier for the React Server Components bugs underneath. Vercel pre-announced this release on October 8, so the patch was expected. What was not obvious until the advisories landed: on the 15.x line, upgrading Next.js can leave the vulnerable image library exactly where it was.

This post is our operator read of the Next.js GitHub advisories, the matching React advisories, and the upstream sharp advisory for CVE-2026-96889.

How to fix

Upgrade Next.js, then prove sharp moved too.

# Next.js 16.x
npm install [email protected]

# Next.js 15.x
npm install [email protected]
npm install [email protected]

# confirm both
npm ls next sharp

Why the extra sharp line on 15.x: [email protected] declares "sharp": "^0.34.3 || ^0.35.5". If your lockfile already holds sharp 0.34.x, that range is satisfied and your package manager has no reason to touch it. There is no fixed 0.34.x release; the only fixed sharp is 0.35.5. So a 15.x app can show [email protected] in npm ls and still ship the vulnerable SVG decoder. [email protected] requires ^0.35.5, so 16.x gets pulled forward on install.

If you would rather pin it in one place, add an override and reinstall:

// package.json (npm)
"overrides": { "sharp": "0.35.5" }

// package.json (pnpm)
"pnpm": { "overrides": { "sharp": "0.35.5" } }

Rebuild and redeploy your container. A Dockerfile that runs npm ci installs whatever the lockfile says, so commit the updated lockfile first.

Next.js 14 and older: the image advisory covers next from 10.0.0 and lists no 14.x fix. If npm ls sharp shows sharp in your tree, pin it to 0.35.5 now and plan the move to 15.5.28 or 16.4.1.

Not on Next.js but using React Server Components (a custom bundler setup, Parcel, or another RSC framework): upgrade react-server-dom-webpack, react-server-dom-parcel or react-server-dom-turbopack to 19.0.9, 19.1.10, 19.2.9 or 19.3.1. On Next.js, upgrade next; App Router uses the React server build that ships inside Next.js, so bumping react in your own package.json is not the fix.

There is no workaround for the use cache RCE or the Server Actions DoS. Upgrade.

Who is not in scope

• Image optimization RCE (GHSA-2464-fhr4-w9xw, CVE-2026-96889): both Vercel and the sharp maintainer scope the code execution to glibc-based Linux. Alpine (musl), macOS and Windows hosts are outside the stated RCE condition. The sharp advisory also says a node binary built as a Position Independent Executable blocks the RCE path, and warns that the official Node.js binaries are not built that way. Distro-packaged Node.js usually is. In practice, the common exposed setup is a Debian or Ubuntu based container running the official Node.js build.
• use cache RCE (GHSA-673q-mjm6-r5xr): Next.js 16.0.0 through 16.4.0 only, App Router with Cache Components, and a use cache function that returns multiple typed arrays. React calls the underlying condition "extremely rare". Next.js 15.x is not listed for this one.
• Server Actions DoS (GHSA-p3m5-59mp-jv5r): Pages Router apps and App Router apps with no Server Actions are not affected, per the advisory.
• Static exports (output: 'export') have no Next.js server at runtime, so none of the three apply. React's own advisory says the same for any React app that does not use a server.

One operator check

Run this inside the deployed container or on the host that serves the app, from the app directory:

node -p "require('sharp/package.json').version + ' librsvg ' + require('sharp').versions.rsvg"
ldd --version 2>&1 | head -1
file "$(command -v node)"

You want 0.35.5 librsvg 2.63.2 on the first line. The second line tells you glibc or musl. On the third, pie executable means your Node.js build is position independent; a plain executable on a glibc host with an old sharp is the combination the advisory warns about. Patch regardless of what the last two lines say.

What this is not

This is not a known in-the-wild exploit today: none of the advisories report exploitation, and none of these issues is in the CISA Known Exploited Vulnerabilities catalog as of version 2026.10.14.

The details

The image bug has been fixable for two weeks. sharp 0.35.5 shipped on 2026-09-27 with librsvg 2.63.2, and the sharp advisory for CVE-2026-96889 went public on 2026-09-30. Vercel's pre-announcement said two of today's fixes were held back from the September release for upstream coordination. So any fresh install since late September already pulled the fixed sharp. Apps that build from an older lockfile did not, and that is most production deploys. If you only take one thing from this post, check the sharp version in the running artifact, not in package.json.

The React side. React published two advisories at about 1:08 PM ET: GHSA-xqc2-xf4c-x3h3, an unauthenticated RCE in React Server Components when a response carries multiple typed arrays and an attacker-controlled value, and GHSA-h3gv-c5rc-p453, a Server Functions DoS. Their descriptions line up with the Next.js use cache RCE and the Server Actions DoS. At the time of writing, CVE-2026-96889 is the only CVE ID assigned across the set; the rest are GHSA-only.

If you followed our write-up of the September 2026 Next.js security release, this is the follow-up that pre-announcement promised. It is a separate upgrade: 15.5.27 and 16.4.0 are both vulnerable to today's issues.

References

• Next.js GHSA-2464-fhr4-w9xw: RCE in Image Optimization API with SVG
• Next.js GHSA-673q-mjm6-r5xr: RCE in use cache functions returning typed arrays
• Next.js GHSA-p3m5-59mp-jv5r: DoS in App Router Server Actions
• React GHSA-xqc2-xf4c-x3h3: RCE in React Server Components
• React GHSA-h3gv-c5rc-p453: DoS in Server Functions
• sharp GHSA-wq5f-xc86-pv6w: librsvg CVE-2026-96889
• CVE-2026-96889 on cve.org
• Next.js: Upcoming security update for upstream vulnerabilities (Oct 8 pre-announcement)