Date: October 16, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Web Application Security / Framework Vulnerabilities / Remote Code Execution / DevSecOps
Tags: Next.js, Vercel, React Server Components, CVE-2026-96889, GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, sharp, librsvg, The Hacker News
Executive Summary
On October 14–16, 2026, web developers and DevSecOps engineering teams worldwide mobilized to address an emergency out-of-band security advisory issued by Vercel for the widely adopted Next.js full-stack web framework. As detailed by The Hacker News and Vercel's official security releases, the updates remediate two critical vulnerabilities enabling unauthenticated remote code execution (RCE) alongside a high-severity denial-of-service (DoS) flaw.
Both RCE flaws carry severe CVSS base scores of 9.5. The first critical vulnerability (GHSA-673q-mjm6-r5xr) resides within the React Server Components (RSC) deserialization pipeline when handling cached components returning multiple typed arrays. The second critical vulnerability (CVE-2026-96889 / GHSA-2464-fhr4-w9xw) involves memory corruption within the underlying librsvg image rendering library invoked through the bundled sharp image optimization package on glibc-based Linux systems. Vercel released Next.js 16.4.1 and Next.js 15.5.28 to neutralize both vulnerabilities, urging immediate rebuilds and redeployments across all production applications.
Deep-Dive Technical Breakdown of the Next.js Vulnerabilities
The out-of-band updates resolve three distinct security vulnerabilities spanning modern React server architecture and server-side image processing:
1. Critical RCE in React Server Components Cache Serialization (GHSA-673q-mjm6-r5xr)
The first critical vulnerability affects the core plumbing that powers React Server Components in Next.js 16 App Router applications:
* The Affected Component: The flaw exists within the official React server serialization packages (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, versions 19.0.0 through 19.3.0).
* The Trigger Mechanism: In Next.js 16 applications utilizing Cache Components (use cache), when a cached function returns a response transporting more than one typed array alongside an attacker-controlled input value, the deserialization handler experiences a structural boundary flaw.
* Arbitrary Code Execution: By submitting a crafted network payload designed to manipulate internal object references during RSC payload decoding, an unauthenticated attacker can corrupt heap objects, achieving remote code execution within the Node.js server runtime.
2. Critical Memory Corruption in SVG Processing via sharp and librsvg (CVE-2026-96889)
The second critical vulnerability stems from server-side vector graphics rendering:
* The Vulnerable Pipeline: When applications enable dangerouslyAllowSVG in Next.js image optimization or use next/og on Node.js to generate social-preview images dynamically, user-supplied SVG files are parsed by the sharp image processing package, which wraps the native C/C++ librsvg library.
* The Memory Corruption Bug: On glibc-based Linux environments, crafted SVG files containing malformed XML elements and recursive style directives trigger an out-of-bounds heap write or use-after-free (UAF) condition in librsvg (versions prior to 2.63.2).
* Remote Code Execution: Unauthenticated remote attackers who upload or supply URLs to malicious SVG graphics can trigger memory corruption, redirecting process control flow to execute arbitrary shell commands under the privileges of the Node.js application process.
3. High-Severity Denial of Service in Server Actions (GHSA-p3m5-59mp-jv5r)
The updates also resolve an algorithmic denial-of-service vulnerability:
* Algorithmic Complexity Exhaustion: In App Router applications exposing at least one Server Action, attackers can transmit crafted multi-part form requests that cause the server-side action dispatcher to enter an infinite loop or excessive CPU parsing state, exhausting server worker processes and denying service to legitimate clients.
Vulnerability Parameter
Flaw 1: RSC Cache RCE
Flaw 2: SVG librsvg RCE
Flaw 3: Server Actions DoS
Tracking Identifier
GHSA-673q-mjm6-r5xr
CVE-2026-96889 / GHSA-2464-fhr4-w9xw
GHSA-p3m5-59mp-jv5r
CVSS v3.1 Base Score
9.5 (Critical)
9.5 (Critical)
7.5 (High)
Vulnerability Class
Insecure Deserialization / Memory Corruption
Memory Corruption (CWE-119 / CWE-787)
Algorithmic Resource Exhaustion (CWE-400)
Affected Versions
Next.js 16.0.0 - 16.4.0
Next.js 10.0.0 - 15.5.27 & 16.0.0 - 16.4.0
Next.js 13.0.0 - 15.5.27 & 16.0.0 - 16.4.0
Fixed In
Next.js 16.4.1
Next.js 16.4.1 / 15.5.28 (with sharp >= 0.35.5)
Next.js 16.4.1 / 15.5.28
Attack Vector
Network (Unauthenticated)
Network (Unauthenticated)
Network (Unauthenticated)
Reporting Disclosure
The Hacker News
The Hacker News
The Hacker News
Recurring Image-Processing Risks in Web Frameworks
The disclosure of CVE-2026-96889 marks the third major image-processing vulnerability discovered in Next.js since August 2026:
* Native C/C++ Binding Vulnerabilities: High-performance image packages like sharp rely on compiled native C/C++ dependencies (libvips, librsvg, libheif). A memory bug in these low-level libraries directly compromises the memory space of the host Node.js application process.
* The "dangerouslyAllowSVG" Tradeoff: Scalable Vector Graphics (SVG) are inherently XML text documents capable of containing embedded CSS, JavaScript, and external entity declarations, making them a recurring vehicle for Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), and memory exploitation.
Recommendations and Mitigations
Organizations running Next.js in production should execute the following remediation protocol immediately:
1. Upgrade Next.js and Redeploy Immediately:
* For Next.js 16 installations: Upgrade to Next.js 16.4.1.
* For Next.js 15 installations: Upgrade to Next.js 15.5.28.
2. Explicitly Verify sharp Dependency Version:
* While Next.js 16.4.1 enforces sharp 0.35.5 or later, Next.js 15.5.28 package manifests may still resolve older cached versions of sharp 0.34.x.
* Run npm ls sharp or pnpm why sharp in your project root to confirm sharp is at version 0.35.5 or higher (which bundles patched librsvg 2.63.2).
3. Apply Emergency SVG Processing Workaround:
* If framework upgrades cannot be deployed immediately, block SVG loading directly in sharp configuration by implementing:
sharp.block({ operation: ["VipsForeignLoadSvg"] })
* Audit next.config.js and ensure dangerouslyAllowSVG is set to false unless strictly necessary.
4. Deploy Web Application Firewall (WAF) Filtering:
* Configure WAF rules inspecting incoming HTTP requests to Next.js routes, blocking malformed multipart requests targeting Server Action endpoints and filtering uploaded SVG files containing suspicious nested XML tags.