Next.js 16.4.1 Security Fix: Are You Vulnerable to 2 Critical RCE Bugs? How to Check and Patch

Suppose your Next.js application is running version 16.4.0. Everything builds successfully, production monitoring looks normal, and your dependency audit reports nothing alarming.

Does that mean your application is secure?

Not necessarily.

On October 14, 2026, the Next.js team released version 16.4.1 to address two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) vulnerability.

Both RCE issues carry a CVSS severity score of 9.5, but they affect different parts of the framework. One involves Cache Components and typed arrays. The other involves SVG image processing through an upstream library.

The important question isn't simply whether your application uses Next.js 16. It's whether your deployed version and application architecture expose one of these vulnerable paths.

Here's how to determine that, install the appropriate security update, and verify the fix reached production.

What Did Next.js 16.4.1 Actually Fix?

According to the official Next.js security announcement, the October 14 release addresses three vulnerabilities.

These are distinct vulnerabilities, not three descriptions of the same underlying bug.

1. Critical RCE in Cache Components (GHSA-673q-mjm6-r5xr)

The first issue affects applications using the Next.js App Router with Cache Components.

The vulnerable behavior involves a use cache function returning multiple typed arrays.

Typed arrays are JavaScript structures for working efficiently with binary or numerical data, including Uint8Array and Float32Array.

Consider this illustrative function:

export async function getChartData() {
  'use cache'

  return {
    timestamps: new Float32Array([1, 2, 3]),
    values: new Float32Array([10, 20, 30]),
  }
}

This demonstrates the relevant return-value pattern. It is not a working exploit or proof that this function alone is vulnerable.

The related React security advisory describes unusually specific conditions involving multiple typed arrays and an attacker-controlled value in React Server Components communication.

For Next.js, the important conditions are:

• The application uses the App Router.

• Cache Components are enabled.

• A use cache function returns multiple typed arrays.

• The vulnerable server-side behavior is reachable through attacker-controlled input.

The Next.js advisory identifies versions 16.0.0 through 16.4.0 as affected.

There is no known workaround for affected applications. The maintainers recommend upgrading even when developers believe their application does not use the vulnerable return pattern.

That recommendation matters. Finding no suspicious function during a quick code search is useful information, but it doesn't replace installing a security patch.

2. Critical RCE in SVG Image Optimization (CVE-2026-96889)

The second vulnerability exists in an upstream image-processing library used by Next.js.

Next.js commonly relies on sharp for server-side image optimization. A memory-related vulnerability in the image-processing stack can potentially allow remote code execution when vulnerable SVG processing occurs on glibc-based Linux systems.

The issue is tracked as CVE-2026-96889 / GHSA-2464-fhr4-w9xw.

Its exposure depends on more than the installed Next.js version.

You need to examine:

• Whether the deployment runs on glibc-based Linux.

• Whether untrusted SVG content can reach the affected image-processing path.

• Whether Next.js or the hosting provider performs image optimization.

• Which version of sharp is actually installed and used.

There is an important distinction here.

Next.js does not optimize SVG files by default. Its Image component documentation explains that SVG images are normally left unoptimized and that dangerouslyAllowSVG changes the framework's handling of SVG content.

Consequently, simply displaying an SVG logo does not establish that your application is exploitable.

However, custom image pipelines, permissive image configuration, and server-side image-generation paths deserve closer inspection.

The official workaround is to ensure Next.js uses sharp version 0.35.5 or later. Updating Next.js to the patched release is the recommended long-term action.

This vulnerability also affects older Next.js release lines, including versions as far back as 10.0.0, according to the advisory.

3. High-Severity DoS in App Router Server Actions

The same security release fixes another issue: GHSA-p3m5-59mp-jv5r.

Specially crafted requests targeting an App Router application with at least one Server Action can cause excessive CPU consumption.

That CPU usage can prevent the same server process from handling subsequent requests.

Unlike the two RCE vulnerabilities, this problem affects availability rather than enabling arbitrary code execution.

Applications using only the Pages Router, or App Router applications without Server Actions, are not vulnerable to this particular issue.

For many teams, Server Actions may be considerably more common than cached functions returning typed arrays.

So even if neither critical RCE path is present, the DoS fix remains relevant.

How to Check Whether Your Next.js App Is Vulnerable

A practical security assessment should answer two separate questions:

1. Is a vulnerable version installed?

2. Does the deployed application expose the vulnerable functionality?

Start with the version because it's the easiest finding to verify.

Step 1: Identify Your Installed Next.js Version

From the application directory, run:

npm ls next sharp

For example, an application might report:

my-app
├── next@16.4.0
└── sharp@0.35.4

This is an illustrative output, not a tested application.

If you find Next.js 16.4.0, your application is below the fixed 16.4.1 release.

For this security update, the relevant minimum fixed versions are:

Earlier release branches do not have a patched version listed in the October 14 announcement. Applications on those branches should plan an upgrade to a maintained, fixed release line.

Remember that the version in package.json is only the declared dependency. The lockfile and installed packages determine what gets built.

Step 2: Inspect Cache Components and Server Actions

Search the application for the relevant configuration and directives:

git grep -n -E \
'cacheComponents|use cache|use server'

If Cache Components are enabled, inspect functions using use cache, particularly their return values.

Look for typed arrays such as:

new Uint8Array(...)
new Float32Array(...)
new Float64Array(...)

Check whether those values are returned together from cached functions and whether any relevant inputs are controlled by users.

Also identify Server Actions. Their presence matters to the separate denial-of-service advisory, even if you find no typed-array caching.

A text search is a starting point, not a comprehensive audit. Imported packages, generated code, alternative directives, and deployed configurations may require additional inspection.

Step 3: Review Your Image-Processing Path

Check your Next.js configuration for settings such as:

const nextConfig = {
  images: {
    dangerouslyAllowSVG: true,
  },
}

This is an example of a configuration worth investigating, not a statement that enabling the option automatically creates an exploitable application.

Determine whether untrusted SVG content reaches the server-side optimizer.

Also review custom sharp usage, image-generation