{"contract":"guth-news-publication-v1","article":{"article_id":"674bec48-18c0-4fc9-bac2-42c5b79d26ec","revision":3,"slug":"netlify-patches-critical-next-js-and-react-vulnerabilities-affecting-rce-and-dos-674bec48","title":"Netlify urges Next.js upgrades despite narrower exposure to security flaws","summary":"Next.js 15.5.28 and 16.4.1 fix two critical code-execution vulnerabilities and a high-severity denial-of-service bug. Public deploy previews may also need attention.","body":"Netlify told customers on October 14, 2026, to upgrade and redeploy their Next.js applications following the disclosure of three security vulnerabilities. The fixes are in Next.js 15.5.28 and 16.4.1; Netlify says its hosting infrastructure limits the impact of some flaws, but it still recommends installing the updates as soon as possible.\n\nThe distinction is clearest for the image-processing vulnerability, CVE-2026-96889. According to the Next.js advisory, a memory-related flaw in an upstream library can allow remote code execution on glibc-based Linux systems. Updating the sharp dependency used by Next.js to version 0.35.5 or later is a workaround for this issue; upgrading Next.js supplies a fixed version.\n\nOn Netlify, the Image Optimization API described in that advisory is served by the company's Image CDN rather than a customer's function, so Netlify says that route does not exercise the flaw. Applications rendering untrusted input through next/og ImageResponse remain affected, however. Netlify says the consequence there is a crashed function invocation—not code execution—though exploitation could increase function costs. Those are the host's assessments of its own platform.\n\nThe other critical flaw has no such hosting exemption. It affects App Router applications using Cache Components when a use cache function returns multiple typed arrays. Netlify describes the configuration as unusual but says applications meeting those conditions are vulnerable on its platform. The Next.js team says there is no known workaround and urges users to upgrade even if their applications do not contain similar functions.\n\nThe third vulnerability, rated high severity, lets crafted requests drive excessive CPU use in App Router applications with at least one Server Action, blocking other requests in the same process. Next.js says Pages Router applications and those without Server Actions are not vulnerable. Netlify says its autoscaling serverless architecture keeps a CPU-consuming request in one function from affecting other requests, while warning that exploitation could still raise customers' bills.\n\nRedeploying the main site may leave older public versions exposed. Netlify warns that publicly accessible deploy previews and branch deploys can remain vulnerable until automatically deleted, and suggests removing them manually. Pantheon also places the update work with customers: its notice says they must update dependencies and redeploy, and that it does not update Next.js sites on their behalf.","content_kind":"author_paraphrase","explanation":{"feature":"Next.js 15.5.28 and 16.4.1 fix two critical code-execution vulnerabilities and a high-severity denial-of-service bug. Public deploy previews may also need attention.","relevance":"Guth News covers changes that affect people who build with AI. Read the cited primary sources for the full details.","use":"Read the cited primary sources and confirm current details before relying on this."},"announcement_date":null,"published_at":"2026-10-17T01:22:55.201Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T01:22:55.178Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/sol61-rewrite-20261016/674bec48-18c0-4fc9-bac2-42c5b79d26ec","checker_models":["gpt-6.1-sol"],"claims":[{"claim_id":"claim:p1","evidence_refs":["source:1"]},{"claim_id":"claim:p2","evidence_refs":["source:2"]},{"claim_id":"claim:p3","evidence_refs":["source:1"]},{"claim_id":"claim:p4","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p5","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p6","evidence_refs":["source:1","source:3"]}]},"primary_sources":[{"source_id":"source:1","title":"Netlify, Security Update: Next.js and React vulnerabilities (October 2026)","url":"https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities","fetched_at":"2026-10-16T21:45:11.000Z","sha256":"a6e8e9c68866e4bc5ffbe956db7b1d034aee4dddb7e8da90af906cff1d9a7607","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:2","title":"Next.js (Vercel), Next.js Security Update for Upstream Vulnerabilities","url":"https://nextjs.org/blog/nextjs-security-update-october-14-2026","fetched_at":"2026-10-16T21:45:30.000Z","sha256":"8d2eaa767895d3898344f1dfc2d39b0137d356cf106461a5746dbbd2f2690402","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:3","title":"Pantheon, Next.js Security Release now available","url":"https://docs.pantheon.io/release-notes/2026/10/nextjs-security-release","fetched_at":"2026-10-16T21:45:30.000Z","sha256":"4af933209abeed9a04a2f32fcbfc5e709cf781646d95c6b147a640f0d07a28fe","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"377a7de9-0d89-4060-bfa8-4c302a4eb7f4","envelope_sha256":"355dc35ae338a2cc899c1d15a662016157bdabf2e530797afa647bd0a3e4777f"},"canonical_url":"https://guth.news/articles/netlify-patches-critical-next-js-and-react-vulnerabilities-affecting-rce-and-dos-674bec48","cover_image":{"asset_id":"01d5ebb749bd65fad19caf57d33d7f0fa939d88c16df4313acb0b4682d6f6565","content_type":"image/png","alt":"Illustration: A softly lit workshop bench where a cracked wooden gear in a clockwork assembly is being swapped for a fresh brass one while the other gears keep turning.","kind":"ai_generated","width":768,"height":432,"url":"https://guth.news/images/covers/674bec48-18c0-4fc9-bac2-42c5b79d26ec/3.png"}},"ai_generated":true,"history":[{"revision":3,"published_at":"2026-10-17T01:22:55.201Z","reviewed_at":"2026-10-17T01:22:55.178Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Netlify urges Next.js upgrades despite narrower exposure to security flaws","change_summary":"Headline changed; summary revised; text revised (−138 words).","url":"https://guth.news/articles/netlify-patches-critical-next-js-and-react-vulnerabilities-affecting-rce-and-dos-674bec48?revision=3"},{"revision":2,"published_at":"2026-10-16T21:49:15.680Z","reviewed_at":"2026-10-16T21:49:15.654Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Next.js ships emergency fixes for two critical code-execution bugs; Netlify says its exposure is narrower","change_summary":"Headline changed; summary revised; text revised (+365 words); 2 sources added.","url":"https://guth.news/articles/netlify-patches-critical-next-js-and-react-vulnerabilities-affecting-rce-and-dos-674bec48?revision=2"},{"revision":1,"published_at":"2026-10-15T14:11:18.310Z","reviewed_at":"2026-10-15T14:11:17.488Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Netlify patches critical Next.js and React vulnerabilities affecting RCE and DoS","change_summary":"First published version.","url":"https://guth.news/articles/netlify-patches-critical-next-js-and-react-vulnerabilities-affecting-rce-and-dos-674bec48?revision=1"}]}