Two JavaScript platforms shipped security fixes within a week. Vercel released Next.js 15.5.28 and 16.4.1 on 14 October 2026. The Node.js project released new versions of its 26.x, 24.x and 22.x lines on 21 October 2026. If you run Next.js on a server, patch it first: two of its three flaws are rated Critical, and only the image flaw has a workaround.
Neither vendor says any of these flaws is being attacked. CISA’s entry in the NVD record for the Next.js image flaw marks exploitation as proof of concept, so do not wait for that to change.
- 3Next.js flaws fixed on 14 October: two Critical, one HighSource: Next.js security update, 14 October 2026, and Node.js security releases, 21 October 2026
- 9.5CVSS v4.0 score of both Critical Next.js flawsSource: Next.js security update, 14 October 2026, and Node.js security releases, 21 October 2026
- 10CVEs fixed in the Node.js release of 21 OctoberSource: Next.js security update, 14 October 2026, and Node.js security releases, 21 October 2026
- 4Node.js CVEs rated highSource: Next.js security update, 14 October 2026, and Node.js security releases, 21 October 2026
What Should You Patch First?
The table lists what each release fixes. The order is our reading of the vendor ratings and of how easy a flaw is to reach from the internet.
| Product and branch | Fixed version | Flaw | Severity |
|---|---|---|---|
| Next.js 16.0.0 to 16.4.0 | 16.4.1 | Remote code execution in use cache functions that return typed arrays (GHSA-673q-mjm6-r5xr, no CVE id) |
Critical, 9.5 |
| Next.js 10.0.0 to 15.5.27 and the 16 line above 16.0.0 up to 16.4.0 | 15.5.28 or 16.4.1 | Remote code execution in the Image Optimization API with SVG files (CVE-2026-96889) | Critical, 9.5 |
| Next.js 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0 | 15.5.28 or 16.4.1 | Denial of service through Server Actions (GHSA-p3m5-59mp-jv5r) | High, 8.2 |
| Node.js 26.x | 26.12.1 | Brotli decoder out-of-bounds write (CVE-2026-111497), dns.resolve name truncation (CVE-2026-105482), two TLS hostname bypasses (CVE-2026-105483, CVE-2026-106069) | High |
| Node.js 24.x | 24.22.1 | The same four flaws | High |
| Node.js 22.x | 22.23.4 | Brotli, dns.resolve and one TLS hostname bypass (CVE-2026-106069); CVE-2026-105483 does not affect 22.x | High |
Node.js also fixed three medium and three low flaws. Its release adds updated c-ares, Undici and CA certificate data on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x.
What Is Wrong in Next.js?
Vercel’s post names three flaws. The first affects applications that use the App Router with Cache Components and have a use cache function that returns multiple typed arrays. Vercel calls it unauthenticated remote code execution and lists the related React advisory GHSA-xqc2-xf4c-x3h3.
The second is CVE-2026-96889 in the Image Optimization API. Vercel says a memory flaw in an upstream library can lead to remote code execution when Next.js runs on glibc-based Linux and SVG files are used. The NVD record for the same id describes a use-after-free in the librsvg library. As a workaround, Vercel says to make sure the sharp version used by Next.js is 0.35.5 or later.
The third lets crafted requests to an App Router application with at least one Server Action use excessive CPU, which blocks other requests in the same process. Vercel says applications on the Pages Router, or without Server Actions, are not vulnerable.
Last year’s React2Shell flaw in React Server Components is a reminder that framework flaws reach many applications at once. Our React2Shell reality check shows how fast the picture changed after disclosure.
What Is Wrong in Node.js?
Node.js rates four of its ten fixed CVEs as high. The release note is short and gives no trigger details, so read it as a list of what to update rather than a guide to attacks.
- CVE-2026-111497: the Brotli decoder has an out-of-bounds write that permits remote code execution.
- CVE-2026-105482:
dns.resolvetruncates names that contain a NUL character. - CVE-2026-105483 and CVE-2026-106069: two ways to get past TLS certificate hostname checks. One uses an IP written in fullwidth digits, the other a host that loosely resolves to an IP address.
Node.js adds that end-of-life versions are always affected when a security release ships. If you still run one, the answer is a move to a supported line.
Is Anyone Exploiting These Flaws?
We found no statement of exploitation from Vercel or the Node.js project. We checked the CISA Known Exploited Vulnerabilities catalog on 21 October 2026, and none of the CVE ids in this post is listed. Two of the Next.js flaws have no CVE id at all, so a catalog entry would be unlikely for them even if attacks began.
The NVD record for CVE-2026-96889 carries a CISA coordinator entry dated 25 September 2026. It marks exploitation as “poc”, automatable as “no” and technical impact as “total”.
In the dark web and Telegram sources we searched for 21 September to 21 October 2026, CVE-2026-96889 appeared in nine posts. Most were automated CVE feeds and news relays. One feed listed a public lab proof of concept for the Next.js case on 16 October. We did not open it.
How Do You Check Your Exposure?
Work through this list for every application and container image, not only the ones you remember.
- Find the Next.js versionRun npm ls next in each project and image. Anything below 15.5.28, or 16.x below 16.4.1, needs the update.
- Search for use cacheLook for the “use cache” directive in your code. Vercel says to upgrade anyway, so this tells you urgency, not whether to patch.
- Check the Image Optimization APIFind out whether your app serves images through it and whether SVG files can reach it.
- Check sharpRun npm ls sharp. Version 0.35.5 or later is the Vercel workaround.
- Check the operating systemRun ldd –version in the image. The advisory names glibc-based Linux and says nothing about other systems.
- Check for Server ActionsSearch for “use server”. With the App Router and one Server Action, the CPU flaw applies.
- Find the Node.js versionRun node –version on servers, build images and CI runners. Compare it with 26.12.1, 24.22.1 and 22.23.4.
- Ask your hostVercel’s post makes no statement about managed hosting. Look for a notice from your own platform.
A list of internet-facing hosts and what runs on them makes the next release cheaper. Our guide to external attack surface management covers how to build one.
What Should You Do After You Update?
Rebuild the image and redeploy, since a changed lockfile on a laptop patches nothing. Then check the running version again to confirm the new code is live. Restart long-lived Node.js processes so they load the new runtime.
Watch the logs of the image endpoint for unusual SVG requests, and watch web processes for child shells or download tools. The vendor advisories publish no indicators of compromise. For ranking the rest of your backlog, see how CVSS, EPSS and CISA KEV signals fit together, and our patch management entry for process basics. The same approach worked for the Oracle October 2026 Critical Patch Update.