Next.js: out-of-band patch for two critical RCEs (CVSS 9.5)

Vercel has released security updates for Next.js, the React framework behind a huge number of web applications, outside its normal release cycle. The fixes close two critical vulnerabilities that allow a remote, unauthenticated attacker to run code on the server. The news was reported by The Hacker News on 15 October 2026 and picked up in advisories from INCIBE-CERT (Spain, 16 October) and from SingCERT at Singapore’s Cyber Security Agency (20 October).

According to SingCERT, both flaws have a CVSS v4.0 score of 9.5 out of 10. None of the three sources mentions active exploitation or public exploits, and no indicators of compromise have been published.

The two vulnerabilities

GHSA-673q-mjm6-r5xr (Cache Components). It affects applications that use the App Router with Cache Components, when a function with the use cache directive returns multiple typed arrays. Under this condition, according to SingCERT, a remote attacker without credentials can achieve code execution. As of the SingCERT advisory (20 October) no CVE had been assigned yet: for now the vulnerability is identified by its GitHub advisory code.

CVE-2026-96889 (image optimization). It is a memory-handling flaw in an external (upstream) library used by the Next.js image optimization feature. According to SingCERT it can be exploited when Next.js runs on glibc-based Linux, and it also leads to unauthenticated remote code execution. The Hacker News headline links this flaw to SVG processing; the other available sources refer to image optimization in general. SingCERT’s references also include the GitHub advisory GHSA-2464-fhr4-w9xw.

The sources do not name the external library or describe the memory flaw in detail.

Affected and fixed versions

Branch	Affected versions	Fixed version
16.x	16.0.0 to 16.4.0	16.4.1
10.x – 15.x	10.0.0 to 15.5.27	15.5.28

INCIBE-CERT specifies that the Cache Components flaw only affects the 16 branch (16.0.0 to 16.4.0), while the image optimization flaw affects both versions 10.0.0 to 15.5.27 and the 16 branch up to 16.4.0. The text of the Spanish advisory we could read is incomplete, so the exact conditions should be checked against the official Next.js advisories.

Attack vector

In both cases the attack comes over the network against an exposed application, with no authentication and no user interaction: in MITRE ATT&CK terms this is the textbook case of T1190, Exploit Public-Facing Application. RCE on a Next.js server gives the attacker the privileges of the Node.js process, and with them access to environment variables, API keys, database credentials and internal services reachable from the server.

Image optimization is enabled by default in Next.js and is used through the next/image component: for this reason the second flaw may affect many applications, although the sources do not say how many.

Why it matters for European and Italian companies

Next.js powers corporate websites, online shops, customer and supplier portals, admin panels and SaaS products. It often runs in containers or on servers managed by agencies and external suppliers, which companies do not always know in detail. The affected 10–15 range spans several years of releases: even old, poorly maintained applications may be vulnerable.

For NIS2 entities this falls under vulnerability and supply chain management: it is worth documenting which applications use Next.js, who maintains them and when they were last updated. Any significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). In healthcare, check patient portals, online booking and suppliers’ web applications, which may process health data.

What to do now

1. Find your Next.js applications: in your repositories look for the next dependency in package.json and check the actual version with npm ls next (or with the package manager you use). Ask agencies and suppliers to confirm for applications you do not develop yourself.
2. Update to 16.4.1 or 15.5.28, as the advisories recommend. For applications still on versions 10 to 14, the advisories list 15.5.28 as the fixed version: plan the major version upgrade and the related testing.
3. Rebuild and redeploy: updating the dependency file is not enough. Container images and builds already deployed contain the old version until they are rebuilt.
4. Prioritise applications exposed to the Internet, those using use cache with Cache Components and those running on glibc-based Linux.
5. If you cannot update right away, the sources do not mention workarounds. Consider restricting access to the application and check the official Next.js advisories for alternative measures, for example regarding image optimization. Do not postpone the update based on your system type: the glibc condition applies to only one of the two flaws.
6. Look for signs of compromise: unusual requests to the image optimization endpoint (/_next/image), unexpected child processes spawned by the Node.js process, unusual outbound connections from the application server. If you find suspicious traces, rotate the keys and credentials reachable from the application.

How ARXDOME helps

The ARX Sentry inventory lists software, processes and ports on servers with the agent: it helps you see where Node.js applications that need checking are running. ARX Shield shows open vulnerabilities by machine and by package, and ARX Expose shows your company’s public services and recognised products: together they help you decide which applications to start with.

Last updated: 20 October 2026