Vercel fixed two critical, unauthenticated remote code execution vulnerabilities in Next.js on 14 October 2026. Upgrading is the first step. This post covers the second: confirming that the running application really got both fixes, and what public sources say about attacks nine days later.
Our Next.js and Node.js patch guide lists every fix in the release. Read it first if you have not patched.
What Are the Two Next.js RCE Vulnerabilities?
The first is the use cache flaw GHSA-673q-mjm6-r5xr. It affects Next.js 16.0.0 to 16.4.0 applications that use the App Router with Cache Components. It has no workaround and, as of 23 October, no CVE id.
The second is CVE-2026-96889 in the Image Optimization API. It affects Next.js 10.0.0 to 15.5.27 and the 16 line above 16.0.0 up to 16.4.0 on glibc-based Linux when SVG files are used. Both score 9.5 on CVSS v4.0 in the Next.js advisories. The fixed versions are 15.5.28 and 16.4.1. Of the two RCE fixes, the 15.5 line gets the image fix only.
The third flaw of the release, a Server Actions denial of service, was published as CVE-2026-94482 on 22 October. The NVD record marks it awaiting analysis and repeats the 8.2 score.
Can an Upgrade Still Leave sharp Behind?
The image flaw lives in a library bundled with sharp, the image tool Next.js uses. Vercel’s workaround is sharp 0.35.5 or later, and it says upgrading Next.js brings a fixed sharp automatically.
The package manifests show why that is worth checking. We read them in the npm registry on 23 October 2026.
| Next.js version | sharp range it accepts |
|---|---|
| 15.5.27 | 0.34.3 or later 0.34.x, or 0.35.4 or later 0.35.x |
| 15.5.28 | 0.34.3 or later 0.34.x, or 0.35.5 or later 0.35.x |
| 16.4.0 | 0.35.4 or later 0.35.x |
| 16.4.1 | 0.35.5 or later 0.35.x |
Our reading: 16.4.1 forces a fixed sharp, but 15.5.28 still accepts the 0.34 line. A lockfile that resolved to sharp 0.34 can satisfy that range, so the image fix may not reach a 15.5 application. Run npm ls sharp in the built image, not on a laptop, and confirm 0.35.5 or later.
Does React Need a Patch Too?
Vercel lists two upstream React advisories next to its own. The remote code execution one is GHSA-xqc2-xf4c-x3h3, rated 9.5. It covers react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel in 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0. Fixes are 19.0.9, 19.1.10, 19.2.9 and 19.3.1.
React’s own text is more measured than the headlines. It says the flaw affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Vercel’s advice stays the same: upgrade even if you have no such function. Other frameworks built on React Server Components can pull the same packages, so check them too. Last year’s React2Shell flaw showed how one React Server Components bug reached many frameworks at once.
What Do the Public Proofs of Concept Show?
We searched GitHub on 23 October for each id. We read the README files as data and did not run or link any code.
- GHSA-673q-mjm6-r5xr: one repository, created 17 October, with no stars. Its author claims a working chain and a lab with a vulnerable and a patched build.
- CVE-2026-96889: three relevant repositories. One is a research write-up created on 21 September, before the Next.js fix. One is a lab proof of concept created on 16 October. One is a project checker created on 23 October.
These are claims by their authors, not our findings. The use cache author says the RCE step depends on a Server Action that the application already exposes. The image lab author says upgrading Next.js without the fixed sharp leaves a build vulnerable. Both match the checks above, so review your Server Actions and your sharp version.
Is Anyone Attacking These Flaws?
Neither Vercel nor React says any of the flaws is exploited, and the CISA catalog, last updated on 21 October, lists none of the CVE ids in this post. The use cache flaw has no CVE id, so the catalog could not list it.
On X we found 51 original posts between 14 and 23 October about these flaws. Most are news relays, patch reminders and weekly roundups. The widest early reach came from a news outlet:
“Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws”
@TheHackersNews on X, 15 October 2026, The Hacker News post on X. The rest of the post gives the ids and a link to its article.
In the Telegram channels our dark web source covers, we found nine unique posts from 15 to 22 October. They are automated CVE feeds and news relays. Treat the proofs of concept as the real risk.
How Many Critical Next.js Flaws Came in Two Months?
The Next.js repository lists five critical advisories since late August. Two arrived on 14 October.
| Published | Identifier | Area |
|---|---|---|
| 25 August | CVE-2026-75604 | Remote code execution on Windows-hosted servers |
| 25 August | GHSA-2xp9-vwfh-vxw4 | Remote code execution in Image Optimization with AVIF files |
| 22 September | CVE-2026-94545 | Remote code execution in the ImageResponse feature |
| 14 October | GHSA-673q-mjm6-r5xr | Remote code execution in use cache functions |
| 14 October | CVE-2026-96889 | Remote code execution in Image Optimization with SVG files |
Two of the five have no CVE id, so a scanner that only reads CVE lists can miss them. Keep a list of every Next.js application you run, with its version and where it is hosted. Our external attack surface management guide explains how to build that list for internet-facing assets.
How Do You Confirm Both Fixes?
- Check the running versionRead the version inside the deployed container, not the lockfile on a laptop. Need 16.4.1 or later on the 16 line and 15.5.28 or later on the 15 line.
- Check sharpRun npm ls sharp in the built image. Version 0.35.5 or later closes the image flaw.
- Check the React packagesRun npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel. Fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1.
- Review Server ActionsList each action and what it can reach. Remove or guard any that run shell commands or touch sensitive data.
- Check the systemThe image flaw names glibc-based Linux. Run ldd –version in the image to see which libc you have.
- Look at the logsWatch for web processes that start shells or fetch tools, and for repeated cache read errors in Next.js 16 logs.
Record the result for each application. A patch that is not verified in the running image counts as not done in the next audit, as our patch management entry explains.