// AI threat desk · 16 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalRCECVSS 9.5 / 7.8

Next.js out-of-band update fixes two critical RCE flaws and a DoS flaw

Next.js fixed two critical remote-code-execution flaws and a high-severity denial-of-service flaw on October 14, The Hacker News said.

· 2 min read
AI-generated image of hands reviewing security updates on a laptop beside server equipment.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News said Next.js fixed two critical remote-code-execution flaws and a high-severity denial-of-service flaw.
  • The Hacker News said the fixes are in Next.js 16.4.1 and 15.5.28.
  • The Hacker News said there were no public reports as of October 15 that the three flaws had been used in attacks.

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution and a high-severity denial-of-service flaw, The Hacker News said.

Vercel, which develops Next.js, rated both code-execution flaws critical, each with a CVSS score of 9.5. As of October 15, there were no public reports that any of the three flaws had been used in attacks, The Hacker News said.

React said crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. React said applications whose React code does not use a server, or that do not use a framework, bundler or bundler plugin supporting React Server Components, are not affected by this vulnerability.

On this page

React Server Components flaw affects specific version ranges

React said crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. The issue affects extremely rare cases involving responses that transport multiple typed arrays and an attacker-controlled value.

Affected versionsFixed version
19.0.0 through 19.0.819.0.09
19.1.0 through 19.1.919.1.10
19.2.0 through 19.2.819.2.9
19.3.019.3.1

Netlify described the impact on its platform

Netlify said the same flaw is reachable through next/og ImageResponse, and apps that render untrusted input via ImageResponse are affected. On Netlify, a malicious request that consumes excessive CPU in one function does not affect other requests, although active exploitation could increase function costs.

Netlify said the impact is limited to a crashed function invocation rather than code execution in its environment. The company also warned that publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted.

React recommends updating immediately. It backported fixes to versions 19.0.09, 19.1.10, 19.2.9 and 19.3.1.

Netlify recommended upgrading Next.js to 15.5.28 or 16.4.1 and redeploying as soon as possible. It warned that publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted.

What to do now

  1. Update immediately.
  2. Upgrade Next.js to 15.5.28 or 16.4.1 and redeploy as soon as possible.

FAQ

What happened in the Next.js security update?

The Hacker News said Next.js released an out-of-band update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution and a high-severity denial-of-service flaw.

Has the Next.js vulnerability been exploited?

The Hacker News said that as of October 15, there were no public reports that any of the three flaws fixed on October 14 had been used in attacks.

Who is affected by the React Server Components vulnerability?

The vulnerability exists in the listed React versions, and crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. React says apps whose React code does not use a server, or that do not use a framework, bundler or bundler plugin supporting React Server Components, are not affected.

How should Next.js users fix the flaws?

Netlify recommends upgrading Next.js to 15.5.28 or 16.4.1 and redeploying as soon as possible. React recommends updating immediately.

Sources

  1. Unauthenticated Remote Code Execution in React Server Components, GitHubPrimary
  2. GHSA-wq5f-xc86-pv6w - GitHub Advisory Database, GitHubPrimary
  3. Next.js & React security release (Oct 2026): what to know, NetlifyPrimary
  4. Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing, The Hacker News
How we checked this story
ClaimSourceStatus
The Hacker News said next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution and a high-severity denial-of-service flaw.The Hacker NewsAttributed
The Hacker News said the fixes are in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support releases.The Hacker NewsAttributed
Vercel rated both code-execution flaws critical.Vercel, via The Hacker NewsAttributed
Vercel rated both code-execution flaws at a CVSS score of 9.5.Vercel, via The Hacker NewsAttributed
Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution.React, via GitHubConfirmed
The React Server Components vulnerability affects extremely rare cases involving multiple typed arrays and an attacker-controlled value.React, via GitHubConfirmed
The React Server Components vulnerability affects versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0.React, via GitHubConfirmed
React backported fixes to versions 19.0.09, 19.1.10, 19.2.9 and 19.3.1.React, via GitHubConfirmed
React says applications without server-side React code are not affected.React, via GitHubConfirmed
React says applications without a framework, bundler or bundler plugin supporting React Server Components are not affected.React, via GitHubConfirmed
The librsvg vulnerability can lead to possible remote code execution on glibc-based Linux under certain runtime-specific conditions.sharp, via GitHubConfirmed
The sharp advisory recommends upgrading to version 0.35.5, which provides librsvg 2.63.2.sharp, via GitHubConfirmed
Netlify says the image-processing flaw is reachable through next/og ImageResponse when applications render untrusted input.NetlifyConfirmed
Netlify says the image-processing flaw has limited impact on its autoscaling serverless architecture, although exploitation could increase function costs.NetlifyConfirmed
Netlify says malicious requests consuming excessive CPU in one function do not affect other requests, although exploitation could increase function costs.NetlifyConfirmed
The Hacker News said as of October 15, there were no public reports that any of the three flaws fixed on October 14 had been used in attacks.The Hacker NewsAttributed
Netlify warns that publicly available deploy previews and branch deploys may remain vulnerable until automatically deleted.NetlifyConfirmed
Red Hat scored the librsvg vulnerability 7.8 and said exploiting it needs user interaction, such as opening a malicious file.Red Hat, via The Hacker NewsAttributed

Could not verify

  • Whether the three flaws have been exploited in the wild is not established.
  • How many applications or users are affected is not established.
  • Whether the React Server Components flaw has a CVE assignment is not established.
  • Whether the three flaws are linked to a common attacker or campaign is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok