Two unauthenticated RCE flaws at once: Next.js 16.4.1 and 15.5.28 are a patch-today release

On October 14, 2026, Vercel shipped an out-of-band security update for Next.js: versions 16.4.1 and 15.5.28. This is not a routine patch to schedule for the next sprint. It is an update whose announcement says, in effect, upgrade immediately. It fixes three issues at once: two unauthenticated remote code execution vulnerabilities rated Critical, and one denial-of-service vulnerability rated High. If you run a Next.js application in production, this article gives you the conclusion first, then the details that decide whether you are affected, how to check, and in what order to upgrade.

The most important judgment first: the real risk in this update is not the upgrade command, which is two lines. It is the assumption "we probably are not affected." Two of the three flaws need no login at all; anyone who can send a request to your application can reach them. And the two code paths they hit, caching functions and image optimization, are paths most Next.js applications walk by default. Thinking you "don't use that feature" often just means you haven't noticed the framework using it on your behalf.

The three flaws, one by one

The first flaw, GHSA-673q-mjm6-r5xr, is rated Critical with a CVSS 4.0 score of 9.5. It affects applications using App Router with Cache Components: when a "use cache" function returns multiple typed arrays, an unauthenticated remote attacker can execute arbitrary code. The affected range is Next.js 16.0.0 through 16.4.0, and the only fixed version on that line is 16.4.1. The official announcement carries a sentence worth memorizing: there is no known workaround for affected applications, and you should upgrade immediately even if your application does not have similar functions. The subtext is that the vendor has already made the scoping decision for you; do not spend the disclosure window re-litigating it.

The second flaw, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), is also Critical and also scores 9.5. It sits in the Image Optimization API's handling of SVG files: a memory-related problem in an upstream library that can lead to remote code execution when Next.js runs on glibc-based Linux. It has the widest affected range of the three: versions 10.0.0 through 15.5.27, and 16.0.0 through 16.4.0. In other words, nearly every still-supported older line is in scope. The interim mitigation is to make sure the sharp version used by Next.js is 0.35.5 or later; the real fix is upgrading to 15.5.28 or 16.4.1, which makes package managers bring in a fixed sharp automatically.

The third flaw, GHSA-p3m5-59mp-jv5r, is rated High with a CVSS 4.0 score of 8.2. It targets App Router applications that use Server Actions: crafted requests can drive CPU usage high enough that further requests in the same process stop being handled, producing a denial of service. Applications on Pages Router, and applications without Server Actions, are not affected by this one. But that exemption covers only the third flaw, not the first two.

Why "out-of-band", and why 15.x users should care twice

The announcement explains the timing: two of these fixes were supposed to land in the September security release but were postponed because of upstream dependency delays. "Out-of-band" means a security release inserted outside the normal cadence. Vercel had announced the upcoming update a week earlier, but the details only became public on October 14. That "announce first, disclose later" rhythm is itself a signal: once details are public, targeted exploitation attempts follow, and the window for upgrading is measured in days, not sprints.

Teams still on 15.x face a second deadline. Under Next.js's two-year maintenance rule, the 15.x line's maintenance period ends around October 21, 2026, which makes 15.5.28 very likely the last security patch that line will ever receive. Upgrading to 15.5.28 stops today's three flaws, but it does not protect against anything discovered after October 21. The right sequence is: upgrade to 15.5.28 today to stop the bleeding, and put the move to 16.x on the calendar for the coming weeks, rather than treating 15.5.28 as a destination.

Singapore's Cyber Security Agency followed on October 20 with alert AL-2026-148, urging users to update immediately. The alert adds no new technical information, but it shows the update has entered the view of national response agencies. For a public-facing service, "the authorities had already issued an alert and we still had not patched" is a difficult position to explain after the fact.

Check first: four commands before upgrading

Before upgrading, spend five minutes establishing where you stand. First, check the next version in your lockfile: anything at or below 16.4.0, or at or below 15.5.27, is in scope, and lines older than 15.5 have no patched version at all and need a larger upgrade plan. Second, check the sharp version: if your image pipeline uses Image Optimization and sharp is below 0.35.5, the interim mitigation for the second flaw is not in place. Third, confirm every deployment shape: self-hosted servers, container images, and edge deployments each need checking, and public preview and branch deployments running old versions are exposed too. Fourth, be careful what you conclude from a clean scan: secondary reporting noted that these advisories were not immediately present in the GitHub Advisory Database that npm audit and Dependabot read from, so a green scan in that window did not prove safety. The official announcement and the advisories themselves are the ground truth, not any single scan result.

One more mistake to avoid during scoping: exempting yourself with "we don't use Cache Components." The official wording for the first flaw closes that door explicitly. Treat the three flaws as a single unit: if your next version is below the fixed version, upgrade, and do not carve out exemptions feature by feature.

Upgrade, then verify it actually landed

The upgrade itself is two lines, exactly as the official announcement states: npm install next@16.4.1 for the 16.x line, and npm install next@15.5.28 for the 15.x line. Upgrade the patch version first; do not use a security fix as an excuse to jump major versions in the same change, because a compatibility regression would pollute the verification of the security fix. After upgrading, do three things: run a build to confirm dependency resolution did not pull in a surprise version; exercise the image pipeline, including SVG and regular images; and if your application uses Cache Components, run the key cached pages to confirm caching behavior is unchanged.

The verification that matters is not "the application starts." It is "no running instance is below the fixed version." Check that the deployed build matches the lockfile, and that every deployment target has actually been redeployed. The most common way these upgrades fail is not a mistyped command but a forgotten surface: an edge node, a preview environment, or a branch deployment nobody has touched in months, still running the old version. The completion criterion for a security update is that no running instance is below the fixed version, not that the main site has been upgraded.

Three lessons for vibe projects

First, write framework versions into your project's health notes. Many vibe projects document features and deployment but not the current framework version or the date of the last security update. The next time an out-of-band update lands, you should be able to answer "which version are we on" in one minute, not after digging through a lockfile. Recording next, Node, and sharp versions with a check date costs almost nothing and pays off exactly when it matters.

Second, keep two upgrade rhythms separate. A patch upgrade should be fast, behavior-preserving, and free of opportunistic refactoring; a major upgrade should be scheduled, regression-tested, and staged. The most dangerous move in this incident would have been mixing the two: jumping to 16.x under the banner of a security fix, hitting an incompatibility, rolling back, and ending up with neither the major upgrade nor the security fix in place. Stop the bleeding first, then plan the route.

Third, pay attention when a vendor writes "upgrade even if you don't have similar functions." That phrasing usually means the scoping is subtler than it looks on the surface, whether because internal framework paths can also trigger the flaw or because the vendor does not want users making risky exemption judgments one by one. When you see that sentence, the default action is to upgrade, not to spend time arguing that you are the exception.

Two unauthenticated remote code execution flaws would each justify an out-of-band release on their own. Two of them together, plus a denial-of-service flaw and a maintenance deadline on the 15.x line, make "upgrade today" the complete argument. The commands are two lines. The real work was never the commands; it is confirming that every running instance got them.