Vercel Next.js — Emergency Patches Released for Critical RCE and Denial-of-Service Flaws (CVE-2026-96889)

Publication date: October 15, 2026
Category: Vulnerability / Web Security

Introduction

Vercel has released an out-of-band security update for Next.js to address multiple high-severity vulnerabilities impacting core web infrastructure. The fixes resolve two independent unauthenticated remote code execution (RCE) vectors and a denial-of-service (DoS) flaw. The affected components include React Server Components through the caching subsystem and the librsvg image processing library integrated via the sharp package. Coordination across maintainers and developers has driven these critical security advisories.

What is the Librsvg and Caching Vulnerability? (General Analysis)

Modern web development ecosystems rely heavily on third-party libraries for asset optimization and server-side state management. The newly discovered vulnerabilities compromise core components of web application architecture:

• CVE-2026-96889 (Librsvg Use-After-Free): A use-after-free memory vulnerability in the librsvg rendering library (CVSS v3.1: 7.8 - High). Official NVD Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE classification: CWE-416. The flaw occurs when processing SVG documents containing nested XML inclusions (Xincludes) with duplicate entity declarations, causing the parser to incorrectly free an XML entity that remains in active use.
• GHSA-673q-mjm6-r5xr (use cache Code Execution): Rated by Vercel with a critical severity score of 9.5 (reasoned estimation based on vendor assessment). It impacts App Router applications with caching components enabled where specific functions return multiple typed arrays alongside attacker-controlled values.
• GHSA-p3m5-59mp-jv5r (Server Actions Denial of Service): A high-severity denial-of-service flaw allowing crafted requests to push a single server process to full CPU utilization, halting further request handling.

How Does It Work? (Technical Analysis)

The exploitation mechanisms highlight the intricate supply chain dependencies and the interaction between Node.js runtimes and native graphic libraries:

• SVG Vector Infection Flow: An attacker submits a malicious SVG file constructed with recursive XML inclusions and duplicate entity declarations. If the application processes this file through the image optimizer (explicitly enabled via dangerouslyAllowSVG or through next/og on glibc-based Node.js runtimes), a memory corruption state is triggered inside librsvg.
• Persistence and Execution Vectors: The memory flaw in librsvg (tracked as CVE-2026-96889) can result in denial-of-service conditions or arbitrary native code execution on the server host, depending on the hardening status of the underlying Node.js binaries.
• React Server Components Vectorization: Within caching subsystems, manipulating multiple typed arrays inside transported responses enables data injection that disrupts server execution logic in applications utilizing use cache.

Affected Systems / Environments

The vulnerabilities affect various version ranges of Next.js and associated dependencies:

• Exposed Platforms: Glibc-based Linux environments with SVG image processing enabled and Next.js applications implementing Server Actions or advanced caching features.

Mitigation and Detection

Remediation

• Immediate Upgrades: Engineering teams must upgrade immediately to Next.js version 16.4.1 (for branch 16) or 15.5.28 (for branch 15).
• Dependency Verification on Branch 15: When upgrading existing installations on version 15, package managers may retain a vulnerable version of sharp (0.34.x). Run npm ls sharp and enforce an update to sharp 0.35.5 or later.
• Temporary SVG Mitigation: If upgrading Next.js immediately is unfeasible, block SVG processing within sharp programmatically:
  javascript Copy

  sharp.block({ operation: ["VipsForeignLoadSvg"] });

Detection

• Infrastructure Monitoring: Security analysts should inspect access logs for anomalous HTTP requests targeting image optimization endpoints (/_next/image) or routes invoking Server Actions with unusually large payloads.
• Dependency Auditing: Utilize Software Composition Analysis (SCA) tools and audit commands to identify outdated versions of sharp and React Server Dom packages.

Operational Warning: Caching component and Server Actions vulnerabilities do not trigger standard automatic alerts in traditional npm audits, necessitating manual reviews of package.json files and deployed framework versions in production environments.

Wrapping Up

Vercel’s release of this out-of-band patch highlights the critical attack surface exposed by complex rendering and caching components in modern web frameworks. The presence of memory corruption vulnerabilities in native libraries like librsvg and logical flaws in React Server Components reinforces the mandatory requirement to keep both direct and transient dependencies updated across all deployment tiers.

References

• Next.js Security Update - October 14, 2026
• GitHub Security Advisory: GHSA-673q-mjm6-r5xr
• GitHub Security Advisory: GHSA-2464-fhr4-w9xw
• GitHub Security Advisory: GHSA-p3m5-59mp-jv5r
• React Security Advisory: GHSA-xqc2-xf4c-x3h3
• Next.js Image Optimization Documentation
• Netlify Changelog: Next.js and React Security Vulnerabilities
• GitHub Advisory: GHSA-wq5f-xc86-pv6w (Sharp)
• Red Hat Security Advisory: CVE-2026-96889
• NVD - CVE-2026-96889