10 Next.js Security Mistakes That Enable Remote Code Execution

So Next.js dropped a security patch on October 14, 2026. Two of the three bugs got a CVSS score of 9.5. That's about as bad as it gets. But here's the thing that actually bugs me. This isn't a "run npm update and move on" situation. There's a trap in the upgrade path. And your scanner might not even tell you about two of the three bugs. Let me walk you through the mistakes I keep seeing. Some of these I've made myself. Some I've watched teams make in the last week. Quick context first, then we get into it.

Read article on: "Are Terminal AI Coders Finally Ready to Replace IDEs?"

What actually happened

On October 14, Next.js shipped an out-of-band patch. Versions 16.4.1 and 15.5.28. Three issues:

As of October 15, nobody had reported these being exploited in the wild. Good news. But the details are public now, so that clock is ticking.

Read article on: "Stop Ignoring Cloud"

Mistake 1, Trusting a clean npm audit

This is the one that scares me most. Because it feels safe when it isn't. As of October 15, two of the three bugs had no CVE yet. They weren't in the npm advisory feed. So npm audit said nothing. Clean report. Green checkmark. And you're still exposed. Only the image bug showed up, and only through sharp's own advisory.

So what do you actually do?

bash

npm ls next
npm ls sharp

Compare what you see to the table above. That's your source of truth right now. Not the scanner.

To be fair to npm, CVE assignment and feed propagation take time. It's not their fault. The mistake is treating a lagging feed as a security verdict.

Read article on: "10 AI Skills to Stay Relevant"

Mistake 2, Upgrading Next.js on v15 and thinking you're done

This one has caught a lot of people. It's the sneaky part of this whole thing.

On v16, upgrade to 16.4.1 and you're good. 16.4.1 requires sharp 0.35.5, so your package manager pulls the fixed version automatically.

On v15, it's different. 15.5.28 still accepts sharp 0.34.x. The broken one. And if you upgrade over an existing install, that old version just stays there. Your package.json says you're patched. Your actual SVG processing is not.

Fix it like this:

bash

npm ls sharp
# shows 0.34.x? then:
npm install sharp@0.35.5

Do this after the Next.js upgrade. Not before. I've seen people check sharp first, see it's fine, upgrade Next.js, and never look again.

Read article on: "HTTP/3 vs HTTP/2"

Mistake 3, Forgetting you turned on dangerouslyAllowSVG

So the SVG bug lives in librsvg, which Next.js reaches through sharp. But here's the part that decides whether you're actually exposed: Next.js doesn't touch SVG files by default.

To serve SVGs through the image optimizer, you have to explicitly turn on dangerouslyAllowSVG. It's literally named that. Someone on the Next.js team was trying to tell us something.

Same library also renders images for next/og , the social preview image thing w,hen it runs on the Node runtime.

Now, turning it on isn't automatically a mistake. Sometimes you need SVG optimization. The mistake is turning it on and forgetting about it. Treating it like a normal config flag instead of what it is: a deliberate expansion of your attack surface.

So go check your next.config.js. Search for dangerouslyAllowSVG. If you don't need it, kill it. If you do need it, write down why, and put it on the list of things to review every time you bump dependencies.

Read article on: "How to Debug Your Brain"

Mistake 4, Thinking "my app doesn't do that" saves you

Vercel's own words in the advisory: "You should upgrade immediately even if your application does not have similar functions."

The trigger for the use cache bug is narrow. App Router, Cache Components on, and a use cache function that returns more than one typed array. React calls it "extremely rare cases."

So the brain goes: "I don't return multiple typed arrays, I'm fine."

Two reasons that logic fails.

One, you might not know your whole dependency tree. Some library you pulled in six months ago could be returning multiple typed arrays from a cached function and you'd never see it.

Two, there's no workaround for this bug. No config flag. No blocking rule. Nothing. Upgrade is the only fix.

Treating a narrow trigger as a reason to wait, when the official guidance says "upgrade anyway," is the mistake.

Mistake 5, Assuming your host has you covered

Netlify came out and said its platform doesn't run the image optimizer code path, so impact is limited there. Cool. But they still recommended the upgrade.

That last bit is what people skip.

A host saying "limited impact on our platform" is not the same as "you're safe." It means one attack path is less of a problem on one specific setup. The use cache and Server Actions bugs are app-level. They don't care where you're hosted.

Upgrade anyway. Host mitigations close one door. They don't close the others.

Mistake 6, Patching sharp and calling it a day

Updating sharp fixes the image bug. That's it. It does nothing for use cache or the Server Actions DoS.

And this mistake is easy to make because the sharp fix is the most visible one. It's the bug that shows up in scanners. It's got a clear version number. So a team updates sharp, the scan goes green, everyone high-fives, and two bugs are still open.

Here's the actual checklist:

• □ Next.js upgraded to 16.4.1 or 15.5.28

• □ npm ls sharp shows 0.35.5+ (especially on v15)

• □ Rebuilt and redeployed

That last one matters. Upgrading without redeploying does nothing.

Mistake 7, Ignoring next/og because "it's just social images"

Social preview images feel like low-stakes stuff. Nobody's going to hack you through a preview card, right?

Wrong, when the code path is shared with a memory bug.

The advisory says the same library behind the SVG flaw also renders images for next/og on the Node runtime. And there's history here. Back in September, a next/og bug let attacker-controlled text change the SVG it generated. A working exploit for that one has already been published.

So no, next/og is not "cosmetic." If it touches input an attacker can influence, it belongs in your security review. Doesn't matter what the feature is called.

Mistake 8, Leaving Server Actions with no throttle

The Server Actions DoS bug is the lowest severity here at 8.2. Which is exactly why it gets pushed to the bottom of the list and forgotten.

Mechanics: if you're on App Router and you have at least one Server Action, crafted requests can pin a server process at full CPU. That process then can't handle anything else. Pages Router apps and apps with zero Server Actions are fine.

So what do you do beyond the patch?

• Rate limit at the edge or reverse proxy for anything backed by Server Actions

• Watch for weird CPU spikes on your server processes

• Remember: one Server Action is enough to put you in the affected group. Even a boring one

Patching closes the specific bug. It doesn't give you DoS resilience in general. Those are different things.

Mistake 9, Treating this as a one-off

This is the third image-processing RCE in Next.js since August. Three in three months.

• August: libheif bug, reached through sharp, code execution via a crafted AVIF

• September: next/og bug, attacker text could alter the generated SVG

• October: librsvg bug (CVE-2026-96889) in the SVG path

And here's the interesting part. Next.js didn't change its own image code this time. 16.4.1 ships the same optimizer as 16.4.0. The fix was just bumping the bundled sharp to 0.35.5, which carries a patched librsvg.

So this isn't a Next.js problem exactly. It's a dependency chain problem. And it keeps happening.

Put sharp, librsvg, and libheif on a watchlist. When sharp drops a release that bumps an underlying image library, look at it, even if no Next.js advisory is attached yet.

Mistake 10, Getting the risk level wrong in both directions

Two credible sources, two very different numbers on the same bug. Worth understanding why.

Red Hat scored the librsvg bug 7.8 and said exploitation needs user interaction, like opening a bad file. Vercel scored the Next.js exposure 9.5 and said it's reachable over the network.

Those aren't contradicting each other. They're describing different things. Next.js is rated higher because the image optimizer can be triggered by network requests in a way the base library can't.

Meanwhile sharp's maintainer points out something important. Whether the bug ends in full code execution or just a crash can depend on your Node.js build. The official Node binaries aren't hardened against this kind of memory attack.

So both common reactions are wrong:

• "Every Next.js app is remotely hackable", overstated

• "This needs user interaction, so it's fine", also wrong

What's actually true:

• use cache bug is narrow (v16, Cache Components on, multiple typed arrays) but has no workaround and is rated critical

• SVG bug is network-reachable on glibc Linux when SVGs hit sharp (via dangerouslyAllowSVG or next/og on Node runtime), and whether it becomes RCE depends partly on your Node build

• Server Actions DoS hits any App Router app with one Server Action

• No public exploitation reported as of October 15

Patch first. Then figure out how urgent it is for your setup specifically.

The patch checklist

If you skimmed everything above, just run this.

bash

# check what you've got
npm ls next
npm ls sharp

# upgrade
npm install next@16.4.1     # v16
# or
npm install next@15.5.28    # v15

# v15 only — do this explicitly
npm install sharp@0.35.5

# then rebuild and redeploy

Then confirm:

If you really can't upgrade Next.js right now, the image bug has a temporary option. Get sharp to 0.35.5+, or block SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }). That's from the sharp advisory.

But the use cache and Server Actions bugs? No workaround. Upgrade is the only thing that closes them. Don't wait on those.

FAQ

I use Pages Router. Am I affected?
Not by the Server Actions DoS. The use cache bug is App Router + Cache Components only. The SVG bug depends on whether SVGs reach sharp on glibc Linux.

Do I need to upgrade if I don't use use cache?
Yes. Vercel's guidance is explicit about this. Upgrade even if you don't have similar functions.

Why didn't npm audit catch it?
Two of the three advisories had no CVE as of October 15 and weren't in the npm feed yet. Feed propagation takes time.

Is upgrading Next.js on v15 enough?
No. 15.5.28 still accepts sharp 0.34.x. Check npm ls sharp and update it yourself.

Has anyone been hacked yet?
Not as of October 15 reporting. No public reports.

Is this the same as React2Shell?
No. Same three React packages, but React calls this one "extremely rare cases." It's much narrower and unrelated in trigger.

Wrapping up

The thing about this patch is that the patching part is easy. Five minutes. The mistakes all happen around it.

Trusting a scanner that can't see two of three bugs. Upgrading on v15 and leaving the bad sharp in place. Reading "limited impact on our platform" as "you're safe." Forgetting that image processing has now caused three RCEs in three months.

Do these five things and you're covered:

1. Upgrade Next.js

2. Check sharp explicitly on v15

3. Look at dangerouslyAllowSVG

4. Rate limit Server Actions

5. Rebuild and redeploy

That's it. Every documented vector in this advisory, closed.

Skip step 2 or step 5, and you might be running an app that says "patched" but isn't. I've seen it happen already.