The Next.js security update fixes two critical unauthenticated remote code execution flaws, including CVE-2026-96889. Upgrade to 16.4.1 or 15.5.28.

Related Posts:

• Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123
• Critical BeyondTrust Remote Support Vulnerability Exploited in the Wild by ARMORY CASTLE
• Chrome 155 Update Fixes 10 Security Flaws, Including Critical Prerender Bug

The post Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update appeared first on Daily CyberSecurity.

Next.js has released security updates for two critical vulnerabilities that could let remote attackers run malicious code without logging in. A third, high-severity flaw could stop affected applications from serving requests.

The issues involve cached functions, SVG image processing, and Server Actions, with fixes available in Next.js 16.4.1 and 15.5.28. Published on October 14, 2026, the advisories describe separate attack paths with different requirements

Both remote code execution flaws score 9.5, while the denial-of-service issue scores 8.2. Application settings and enabled features determine exposure, so version checks are only one part of risk assessment.

The first vulnerability, tracked as GHSA-673q-mjm6-r5xr, affects App Router applications using Cache Components. An application becomes vulnerable when a use cache function returns multiple typed arrays. Under these conditions, attackers could achieve remote code execution without authentication or user interaction.

Next.js releases 16.0.0–16.4.0 are affected by the flaw, which is fixed in version 16.4.1. Developers should upgrade immediately, as no workaround or CVE identifier is available.

Critical Next.js Vulnerabilities

Earlier React and Next.js RCE reports highlight server-side risks, but the newly disclosed cache flaw has a separate trigger and is unrelated to React2Shell.

The second flaw, CVE-2026-96889, involves a memory-related weakness in an upstream library the Image Optimization API uses to handle SVG files. It can lead to remote code execution on Next.js deployments running on glibc-based Linux. The advisory lists no required privileges or user interaction.

The official image optimization advisory lists affected versions as 10.0.0 through 15.5.27 and versions above 16.0.0 through 16.4.0.

Developers can address this issue by ensuring Next.js uses sharp 0.35.5 or later. Installing the patched Next.js releases ensures package managers provide a fixed dependency.

The third vulnerability, GHSA-p3m5-59mp-jv5r, affects App Router applications with at least one Server Action. Crafted requests can drive excessive CPU usage, preventing the same process from handling further requests. Applications using Pages Router, or those without Server Actions, are not vulnerable.

Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. There is no workaround besides upgrading. Previous coverage of Next.js security patches highlights related feature-specific risks, but those earlier fixes do not replace this update.

Developers should install Next.js 15.5.28 or 16.4.1 as appropriate. Updating only sharp addresses the image flaw, not the separate cached-function or Server Actions vulnerabilities.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Next.js Vulnerabilities Allow Hackers to Execute Malicious Code Remotely appeared first on Cyber Security News.

Details and PoC exploit code are public for CVE-2026-94545, an unauthenticated Next.js RCE in next/og. Upgrade to Next.js 16.3.6 now.

Related Posts:

• Stirling PDF RCE CVE-2026-85714: Details and PoC Publicly Disclosed
• Dell System Update Flaw CVE-2026-86360 Could Allow Root Code Execution
• Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach

The post PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545 appeared first on Daily CyberSecurity.

Vercel fixed a critical Next.js RCE vulnerability in image generation. Update to patch this Next.js RCE vulnerability and secure your apps.

Related Posts:

• WordPress Stored XSS Details and PoC Publicly Disclosed
• Critical IBM FTM Vulnerabilities Expose Financial Systems to Attack
• Critical HPE ALE Vulnerabilities Allow Complete Server Takeover

The post Critical Next.js RCE Vulnerability Fixed in Version 16.3.6 appeared first on Daily CyberSecurity.