Direct answer: On 14 October 2026 Next.js published fixes for two critical remote code execution issues and one high-severity denial of service. The patched minimums for these advisories are 16.4.1 and 15.5.28. Version 16.4.3 is the latest stable 16.x release at the 26 October cutoff.
What was fixed
- RCE in use cache: GHSA-673q-mjm6-r5xr affects Next.js 16.0.0–16.4.0 applications with Cache Components and a use cache function returning multiple typed arrays. Fixed in 16.4.1; critical, CVSS 9.5.
- RCE through SVG image optimization: GHSA-2464-fhr4-w9xw, linked to CVE-2026-96889, affects 10.0.0–15.5.27 and 16.0.0–16.4.0 under the advisory’s glibc Linux conditions. Fixed in 15.5.28 and 16.4.1; critical, CVSS 9.5.
- DoS in Server Actions: GHSA-p3m5-59mp-jv5r affects App Router applications with at least one Server Action in 13.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 15.5.28 and 16.4.1; high, CVSS 8.2. The consulted advisory has no assigned CVE.
Which version to install
| Release line | Minimum for these advisories | Current at 26 October 2026 |
|---|---|---|
| 16.x | 16.4.1 | 16.4.3 |
| 15.x | 15.5.28 | 15.5.28 |
| 14.x and earlier | No patch in that line | Migrate to a patched line |
These minimums concern the named advisories. They are not a guarantee against every future vulnerability. The 16.4.3 release contains backported bug fixes.
Mitigations and updating
Upgrade Next.js to a patched release. The use cache and Server Actions advisories provide no workaround. For the SVG issue, the official advisory does describe ensuring that the sharp dependency is at least 0.35.5. A patched Next.js release forces a corrected dependency. That SVG mitigation does not fix the other two issues.
- Check the installed Next.js version and the resolved lockfile, not only a version range in package.json.
- Update an affected 15.x or 16.x installation to a patched version in its line.
- Prioritize image optimization with SVG on glibc Linux and affected use cache functions.
- Rebuild and test the application’s routes, images and Server Actions where used.
- Redeploy the corrected build and confirm which version actually runs in production.
Frequently asked questions
Which Next.js versions fix these issues? 16.4.1 or later in the 16.x line and 15.5.28 in the 15.x line. At this article’s cutoff, 16.4.3 is the latest stable 16.x release.
Are 14.x and earlier patched? These advisories do not offer a patch in those lines. Plan a migration to a corrected release line.
Does this article validate a public exploit? No. The official severity and affected conditions are sufficient reason to prioritize patching without waiting for confirmed exploitation.
Are purely static exports affected in production? A pure static export without a Next.js server, image optimizer or Server Actions does not expose those runtime paths in production. Still review dependencies and the build environment.
Sources and editorial review
- Next.js: use cache RCE, GHSA-673q-mjm6-r5xr.
- Next.js: SVG image optimization RCE, GHSA-2464-fhr4-w9xw.
- Next.js: Server Actions DoS, GHSA-p3m5-59mp-jv5r.
- Release 16.4.3 and release 15.5.28.
Reviewed on 26 October 2026 against the maintainers’ advisories. For feature context, see Next.js 16.4 and Cache Components.
Check the installed version and exposed features, update, build and verify the deployment. The listed minimums fix these particular advisories.
Explore the related service ↗