Guide · Framework security

The October 2026 Next.js security update: who must upgrade

Next.js powers a fast-growing share of business websites, including every one we build. On 14 October its maintainers shipped an out-of-band release for two critical flaws and a serious denial of service. Here is what each one needs to work, which versions are fixed, why version 14 is stuck, and how to check a site in a few minutes.

By Elliot · Published 26 October 2026 · 10 min read

What you need to know

The fixed versions are 16.4.1 and 15.5.28. The image fix also needs sharp 0.35.5 or later.
Self-hosted sites on Linux, and any app using Server Actions, are the ones most exposed.
Next.js 14 and older are affected and got no fix. They need a major upgrade.
No attacks reported yet, but proof-of-concept code is public. Upgrade this week, not this quarter.

What happened

Three flaws, all in code Next.js depends on

None of the three bugs started in Next.js itself. The image flaw lives in librsvg, an open-source library for drawing SVG images, which reaches Next.js through sharp, the library it uses to resize and convert images. The other two are in the React Server Components packages that the App Router is built on. Next.js's job was to ship the fixed versions together.

The librsvg bug was published by Red Hat on 23 September, and sharp released a fixed version on 27 September. Next.js postponed two fixes from its 30 September release while it waited on upstream packages, announced an out-of-band update on 8 October, and shipped it on 14 October. So for three weeks the underlying image bug was public before most Next.js sites could pick up the fix.

Since then, NHS England and Singapore's Cyber Security Agency have both issued alerts. GitHub only added the advisories to its global database on 22 October, the same day the Server Actions flaw got its CVE number, so automated scanners that rely on that database were blind to them for the first week.

The three issues fixed on 14 October 2026 (ratings are Vercel's, CVSS v4)
Issue	Rating	Affected versions	What it needs
Image optimisation RCECVE-2026-96889 (GHSA-2464-fhr4-w9xw)	Critical, 9.5	10.0.0 to 15.5.27, and 16.0.0 to 16.4.0	A self-hosted server on glibc Linux processing images through sharp, which bundles the vulnerable librsvg
"use cache" RCEGHSA-673q-mjm6-r5xr (no CVE yet)	Critical, 9.5	16.0.0 to 16.4.0 only	Cache Components, with a use cache function that returns typed arrays. Upgrade even if you think you have none
Server Actions denial of serviceCVE-2026-94482 (GHSA-p3m5-59mp-jv5r)	High, 8.2	13.0.0 to 15.5.27, and 16.0.0 to 16.4.0	The App Router with at least one Server Action. Crafted requests pin the CPU and stall the site

How widespread

How many projects sit on a version with no fix?

W3Techs for websites, npm for downloads, both read on 26 October 2026.

3.7%

of all websites use Next.js, up from 1.9% a year earlier

Source: W3Techs

44.6m

downloads of the next package from npm in one week, 16 to 22 October

Source: npm

6.7%

of those downloads were Next.js 14 or older, which got no fix

Source: npm, our arithmetic

Nobody publishes which Next.js version live websites run, so the closest measure is npm, which counts every install, by version. The table groups last week's downloads by major version. Downloads overstate active projects, since build servers install the same package many times a day, but the split shows where the ecosystem sits. Only about 31% of that week's downloads were already a fixed version.

npm downloads of next by major version, 16 to 22 October 2026, and each line's status
Version line	Share of downloads	Status after 14 October
Next.js 16	74.1%	Fixed in 16.4.1. Latest is 16.4.3. Active support
Next.js 15	19.2%	Fixed in 15.5.28, with sharp 0.35.5 or later. Maintenance support
Next.js 14	5.3%	No fix. Unsupported. Last release 14.2.35, December 2025
Next.js 13 and older	1.4%	No fix. Unsupported

Version 14 is the line to watch. It was released in October 2023, it is listed as unsupported, and it still drew over two million downloads in that one week. Many of those are sites that work perfectly well and that nobody has had a reason to touch. This release is that reason.

Who it hits

How hosting and features change the risk

The same version can be urgent on one site and close to harmless on another.

Self-hosted sites on Linux

Sites run with next start on a VPS, in Docker, or on platforms such as Railway and Render do their own image optimisation through sharp. On glibc-based Linux that is the case Vercel and NHS England describe as reaching code execution. This is the group that most needs to act.

Any app with a Server Action

Server Actions are the App Router feature behind many contact forms, logins and dashboards. One is enough for the denial of service to apply, whatever the hosting. A site that stops answering is a real cost for a business that takes enquiries or bookings online.

Next.js 16 apps using Cache Components

The use cache flaw only exists on version 16, and only bites when Cache Components are on and a cached function returns typed arrays. That is uncommon, but Vercel's advice is to upgrade regardless, and there is no workaround.

Anything still on Next.js 14 or older

Version 14 is outside Next.js's support policy and got no release this time, though both the image flaw and the Server Actions flaw cover it. The only complete fix is a major upgrade to 15 or 16, which takes testing, not a one-line change.

Netlify sites: lower exposure

Netlify serves images through its own image CDN, so the Next.js optimiser path is not used there, and it describes the denial of service as having minimal impact on its serverless set-up. It still tells customers to upgrade and redeploy.

Fully static exports: out of range

A site built with static export is plain files with no Next.js server behind it, so there is no image optimiser or Server Action endpoint to attack. Vercel had not published a statement about its own hosting when we checked, so we make no claim about Vercel-hosted sites.

What to do

Checking and fixing a Next.js site

The first step is for anyone. The rest are a short job for a developer on 15 or 16, and a proper project on 14.

Confirm the site runs on Next.js

View the page source and look for /_next/static/, or open the browser's developer tools: the response headers often include x-powered-by: Next.js, and typing next.version in the console usually prints the version. A browser extension such as Wappalyzer shows it too. If in doubt, ask whoever built the site.

Upgrade to a fixed version

On version 16, move to 16.4.1 or later (16.4.3 is the latest). On version 15, move to 15.5.28 or later. Both releases also update the React packages underneath; developers can confirm with npm ls react-server-dom-webpack, which should show 19.0.9, 19.1.10, 19.2.9 or 19.3.1 or later.

Check sharp separately, especially on 15

The image fix is really a fix to sharp, the image library. Next.js 15.5.28 still accepts sharp 0.34, and no patched 0.34 exists, so an upgrade that keeps an old lockfile can leave the hole open. Run npm ls next sharp and make sure sharp shows 0.35.5 or later.

Check what is deployed, not just the code

Run the version check inside the built image or on the server, because a lockfile on a laptop proves nothing about what is live. Do not lean on an old security scan either: GitHub only added these advisories to its database on 22 October, so an npm audit run before then would have passed.

On 14 or older, plan the major upgrade now

Schedule the move to 15 or 16 and test it properly: forms, logins, payments and anything that reads cookies or headers. While you wait, if the project installs sharp, force it to 0.35.5 or later, or block its SVG loader as sharp's advisory describes. Nothing short of the upgrade fixes the Server Actions flaw on 14.

Make patching somebody's job

This release came with a week's notice, and the underlying image bug was public three weeks before Next.js shipped its fix. The next one is already announced: a scheduled release on 3 November 2026 for seven medium-severity issues. A site with nobody watching for that is exposed for as long as nobody notices. Whether it is your developer, your agency or a care plan, someone should own it in writing.

What the sources do not settle

Four comforting assumptions we would not make

“SVGs are switched off, so we are fine.” Some coverage says the image flaw needs the dangerouslyAllowSVG setting. The official advisory does not say so, and a public proof of concept describes an SVG disguised as another image format. “We use Alpine.” Code execution is described on glibc Linux, but nobody authoritative says Alpine is safe.

“Cloudflare will block it.” Cloudflare shipped an emergency firewall rule on 14 October, but for remote code execution in “popular web frameworks” generally; it names no Next.js issue, and it only sees traffic that passes through Cloudflare. “Our scanner is green.” Scanners fed by GitHub's advisory database could not see these until 22 October, and a scan of a lockfile says nothing about what is running in production.

On severity, NHS England titled its alert critical while rating the overall threat as medium, and the image flaw carries three different scores depending on who scored it. We have not tried any of the published exploits, against our own sites or anyone else's. Our advice does not depend on settling those questions: get onto a fixed version, confirm sharp separately, and check the live build.

FAQ

Next.js security update questions

What was in the October 2026 Next.js security update?

On 14 October 2026 Next.js released 15.5.28 and 16.4.1 to fix three issues in upstream dependencies: a critical remote code execution flaw in image optimisation through the librsvg library (CVE-2026-96889), a critical remote code execution flaw in use cache functions on version 16 (GHSA-673q-mjm6-r5xr), and a high-severity denial of service in Server Actions (CVE-2026-94482).

Which Next.js version should I be on?

16.4.1 or later on the 16 line, or 15.5.28 or later on the 15 line, with the image library sharp at 0.35.5 or later in both cases. The latest release on 27 October 2026 was 16.4.3. Anything on version 14 or older should be upgraded to 15 or 16, because those versions got no fix. Next.js has also scheduled a release for 3 November 2026 covering seven medium-severity issues, so plan to update again then.

Is Next.js 14 affected, and will it get a patch?

Yes, it is inside the affected ranges for both the image optimisation flaw and the Server Actions flaw. Next.js lists 14 as an unsupported version, and the October release did not include a 14.x patch. Next.js did patch 14 once after its support ended, in December 2025, but not this time, so a major upgrade is the only complete fix.

Is anyone exploiting these Next.js vulnerabilities?

No exploitation in the wild had been reported as of 27 October 2026, and none of the three is in CISA's catalogue of known exploited vulnerabilities. Proof-of-concept code is a different matter: NHS England reported one for the image flaw on 19 October, and public repositories claiming working exploits for two of the issues appeared on GitHub around 16 and 17 October.

Am I safe if dangerouslyAllowSVG is switched off?

Do not rely on it. Some news coverage says SVG optimisation needs that setting, but Vercel's advisory does not offer it as a workaround, and one public proof of concept describes disguising the SVG as another image type. Upgrading Next.js and confirming sharp is at 0.35.5 or later is the fix.

Does running in an Alpine Docker image protect my site?

Not demonstrably. Vercel and NHS England describe code execution on glibc-based Linux, but no primary source says Alpine, which uses musl, is safe. sharp ships musl builds with librsvg too, so a crash at least is not ruled out. Treat Alpine as a reason for slightly less alarm, not as a fix.

Why does one flaw have three different severity scores?

Because each organisation scored a different thing. Vercel rates CVE-2026-96889 at 9.5 for how it reaches a Next.js server over the network. Red Hat scored the underlying librsvg bug at 7.8, as a local issue needing user action, and sharp's advisory gives 8.9. The Next.js figure is the one that describes a website.

How common is Next.js?

W3Techs found Next.js on 3.7% of all websites in October 2026, up from 1.9% a year earlier. The next package was downloaded about 44.6 million times from npm in the week to 22 October. Downloads are not live sites, but they show the scale: about one download in fifteen was for version 14 or older.

References