Key points
- Vercel released an out-of-band update on 14 October fixing two critical remote code execution flaws.
- The vulnerabilities affect Next.js versions 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0.
- A third high-severity denial-of-service flaw impacts App Router apps using Server Actions.
Attackers gained the ability to run arbitrary code on servers without authentication, requiring only access to specific application features. This capability allows full compromise of the hosting environment. The weaknesses existed in how Next.js handled cached data and processed vector graphics. Vercel, the developer of the framework, issued an urgent out-of-band security update on 14 October to address these critical issues.
In plain English
The first flaw allows remote code execution through React Server Components when cache functions return multiple typed arrays. This affects Next.js 16 apps using the Cache Components feature. The second flaw is a memory error in librsvg, used by the sharp package for SVG images. It permits code execution on glibc-based Linux systems when dangerous SVG settings are enabled.
The background
Vercel rated both code-execution flaws as critical, each carrying a CVSS score of 9.5. The update also patches a high-severity denial-of-service issue in App Router apps with Server Actions. Crafted requests can exhaust CPU resources, preventing the server from handling other legitimate traffic. These issues span a wide range of framework versions released over recent years.
What changes now
The fixes are available in Next.js 16.4.1 and 15.5.28, which are the current Active and Maintenance long-term support releases. Vercel advises all users to upgrade immediately, even if their applications do not use the specific vulnerable functions. The update covers three separate security issues affecting different parts of the framework’s architecture and image processing pipeline.
The attacker's path
Teams usually monitor for unauthenticated access attempts that target image processing or caching endpoints. Check whether your applications accept user-supplied SVG files or use advanced caching features. Verify that server configurations restrict external input to these components. This stage of an intrusion typically serves as an initial foothold, allowing attackers to establish control before moving laterally.
What to do and how to stay safe: Next.js
- Update Next.js to version 16.4.1 or 15.5.28 immediately to apply the security patches.
- Audit applications for the use of Cache Components and the dangerouslyAllowSVG setting.
- Monitor server logs for unusual CPU spikes or unauthorized code execution attempts.
- Review image processing configurations to ensure SVG handling is restricted where possible.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Next.js versions are affected by these critical flaws?
Versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected by the code-execution flaws.
What does the denial-of-service flaw do?
It allows crafted requests to push server processes to full CPU use, stopping them from handling other requests.
When was the security update released?
Vercel released the out-of-band security update on 14 October.
