Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14, 2026, to address two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) flaw. The first RCE flaw, in React Server Components, affects apps using Cache Components with a use cache function returning multiple typed arrays. The second RCE stems from a memory bug in the librsvg library, accessible through the sharp package when processing attacker-supplied SVG files on glibc-based Linux systems. The DoS vulnerability affects App Router applications with Server Actions, allowing attackers to cause full CPU utilization on a server process.

AI-extracted · verify before operational use