Netlify patches critical Next.js and React vulnerabilities affecting RCE and DoS

Netlify reports that three security vulnerabilities disclosed by the Next.js and React teams on October 14, 2026 have been patched for its customers. All issues are fixed in Next.js versions 15.5.28 and 16.4.1, and Netlify strongly recommends upgrading to one of these releases and redeploying. The critical remote‑code‑execution flaw in use‑cache functions (GHSA‑673q‑mjm6‑r5xr) affects 16.x apps using Cache Components with typed arrays, and upgrading resolves it. A second critical remote‑code‑execution flaw (GHSA‑2464‑fhr4‑w9xw, CVE‑2026‑96889) in SVG image processing can be triggered via next/og ImageResponse; upgrading updates the bundled sharp library and mitigates the issue. The high‑severity denial‑of‑service vulnerability (GHSA‑p3m5‑59mp‑jv5r) impacts App Router apps that define a Server Action, and upgrading also addresses it. Netlify advises deleting any deploy previews or branch deploys that might remain vulnerable until they are automatically removed.