Contact us

Next.js critical RCE flaws and a Node.js security release: check and patch

Next.js RCE flaws: check versions and patch

A critical Next.js update landed on October 14, 2026, and a Node.js security release followed on October 21. If you run a self-hosted Next.js app, check your versions this week. If you run Node.js, rebuild on a fixed release.

What happened

On October 14, 2026 the Next.js team shipped an out-of-band security update, versions 16.4.1 and 15.5.28. It fixes two critical, unauthenticated remote code execution flaws and one high-severity denial of service.

What happened
  • CVE-2026-96889 (GHSA-2464-fhr4-w9xw, CVSS v4 9.5): a memory-related flaw in an upstream image library (sharp). It is reachable through the Image Optimization API when SVG files are used, on glibc-based Linux.
  • GHSA-673q-mjm6-r5xr (CVSS v4 9.5 per a national cyber agency alert, no CVE at the time of writing): remote code execution in App Router apps that use Cache Components when a use cache function returns multiple typed arrays. The vendor says there is no known workaround.
  • GHSA-p3m5-59mp-jv5r (High): denial of service through crafted requests against App Router apps with at least one Server Action.

The attacker needs no credentials. Successful exploitation means code execution as the Node process, which typically holds environment secrets, database credentials and cloud tokens.

Exploitation status: unknown. None of the primary sources we reviewed state that exploitation in the wild has occurred. Unknown does not mean safe. These flaws need no credentials and the vendor has shipped a fix, so patch promptly.

Separately, the Node.js project’s October 21 release (22.23.4, 24.22.1, 26.12.1) fixes several High-rated issues. They include CVE-2026-111497, a Brotli decoder out-of-bounds write that can permit remote code execution when an app decompresses attacker-supplied data. Fastify 4.x and 5.x users should also note CVE-2026-76169, an authentication bypass fixed in 5.12.2.

Are you exposed?

You are likely exposed if you self-host Next.js (Docker, VM, VPS, PaaS container) on 10.x through 15.5.27, or 16.0 through 16.4.0. The risk is highest on glibc-based Linux images (Debian, Ubuntu, RHEL bases) that expose the image optimizer or process untrusted SVGs, including next/og ImageResponse on the Node runtime. The Cache Components flaw applies to 16.x App Router apps that use use cache.

Hosting changes the picture but does not remove it. One hosting platform states that its own image CDN serves the next/image path. It also states that the same flaw is reachable through ImageResponse, where its impact was a crashed function invocation rather than code execution. Do not read that as “hosted means unaffected”. Upgrade anyway.

Check versions in a project:

npm ls next sharp
grep -A2 '"node_modules/next"' package-lock.json
npm audit --omit=dev

Vulnerable means next at or below 15.5.27, 16.0.x through 16.4.0, or sharp below 0.35.5. To check a built image, override the entrypoint so the app does not start. Run this on an isolated host with no secrets mounted and no network:

docker run --rm --network none --entrypoint sh <image> -c 'node -v; npm ls next sharp'

Check Node.js with node -v, and rebuild images, because each image carries its own runtime. Node 20 and older are end-of-life. Look for Brotli use in your code:

grep -rnE 'brotliDecompress|createBrotliDecompress|zlib\.brotli' src/

Signs someone already used it

These checks are general hunting guidance, not published signatures. Absence of a hit is not proof of safety.

  • Image requests from unfamiliar sources, especially url parameters ending in .svg or pointing at external hosts: grep '/_next/image' access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
  • Worker crashes near those requests: journalctl -u <service> | grep -Ei 'segfault|SIGSEGV|SIGABRT|core dumped'
  • Shells or unexpected children of node: ps -eo pid,ppid,user,cmd --forest | grep -A3 node
  • Unfamiliar outbound connections: ss -tnp | grep node
  • New files in temporary directories and new cron or systemd units since October 14.

Unexplained Node restarts after image requests are a lead worth escalating.

Contain it now

If an unpatched, internet-reachable instance shows crashes, unexplained child processes or outbound connections:

Contain it now

1. Isolate the host or container from the network, keeping it running if possible so process state is preserved.

2. Capture evidence in parallel: snapshot the disk, copy proxy and application logs off the box, record process and socket listings, export the container filesystem.

3. Rotate the secrets the Node process could read, in this order: cloud and CI/CD tokens, database credentials, session and JWT signing keys, third-party API keys, then SSH keys. Treat .env files and environment variables as exposed.

4. Rebuild from a clean base image on patched versions. Do not patch a suspect host in place.

5. Review cloud audit and database logs for use of the rotated credentials since October 14.

Fix and harden

  • Upgrade: npm install next@16.4.1 on 16.x, or npm install next@15.5.28 on 15.x, then redeploy. Move older apps to a supported line. Confirm npm ls sharp shows 0.35.5 or higher.
  • Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. The project lists no workarounds for these issues.
  • Interim only: sharp 0.35.5 or higher is the vendor workaround for CVE-2026-96889 alone. Restricting /_next/image at the proxy is a reasonable compensating control for that path, but it is not vendor-endorsed and does not cover the Cache Components flaw.
  • Delete old deploy previews and branch deploys, which may remain vulnerable.
  • Fastify: upgrade to 5.12.2, or reject malformed request targets at the proxy and avoid returning protected data from not-found handlers.
  • Limit blast radius: run Node as a non-root user, keep secrets out of the process environment where possible, filter egress, and use a read-only root filesystem.
  • Keep an inventory or SBOM so the next advisory takes minutes to answer, not days.

When to call incident response

Call for help if an unpatched Next.js app was internet-facing after October 14 and logs show image requests with external or SVG URLs followed by crashes or restarts. Also call if you find unexpected child processes, shells, reverse connections, new cron or systemd entries, or files in temporary directories owned by the Node user. Call too if the app’s cloud or database credentials show unfamiliar activity.

Message us to talk through your Next.js patching plan.

Sources

Discover more from Core-Infosec

Subscribe to get the latest posts sent to your email.

Picture of Core Watch

Core Watch

Practical security guidance from Core-Infosec.

Read More