The out-of-band release fixes a Cache Components RCE, an SVG image-optimization RCE on glibc Linux, and a Server Actions denial of service.
Vercel shipped an out-of-band Next.js security release on October 14. Patched builds are 16.4.1 on the Active LTS line and 15.5.28 on Maintenance LTS. Vercel postponed two of the fixes from the September release because upstream dependencies were not ready.
The first is an unauthenticated remote code execution in App Router applications using Cache Components. GHSA-673q-mjm6-r5xr scores 9.5 and triggers when a use cache function returns multiple typed arrays. Affected versions run from 16.0.0 through 16.4.0. There is no workaround, and Vercel says to upgrade even if your cached functions do not look like the vulnerable shape.
The second, CVE-2026-96889 or GHSA-2464-fhr4-w9xw, also scores 9.5. It reaches the Image Optimization API when that endpoint processes SVG input on glibc-based Linux through a vulnerable bundled image library. Pinning sharp to 0.35.5 or later blocks it without a Next.js upgrade; affected ranges are 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
The third, GHSA-p3m5-59mp-jv5r, scores 8.2. Crafted requests to any App Router app with at least one Server Action burn CPU and stall the process. This one does not touch Pages Router or apps without Server Actions. After you upgrade, run npm ls sharp and redeploy. Cache Components users should treat this as a same-day patch.
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
Next.js moved its August security release forward to Aug 25, shipping 16.3.3 and 15.5.24 to close two critical RCEs, a Windows-only path traversal and a crafted-AVIF image optimization exploit.
1 source
Cross-user cache poisoning in SSG and ISR is the item to act on, and the 15.x line backports only some of the set.
2 sources