Next.js ships emergency fixes for two critical code-execution bugs; Netlify says its exposure is narrower

The Next.js team released an out-of-band security update on October 14, 2026, fixing two critical remote code execution flaws and one high-severity denial-of-service bug. Patched builds are Next.js 16.4.1 and 15.5.28, and the team says two of the fixes were postponed from September's security release because of upstream dependency delays.

The first critical flaw, GHSA-673q-mjm6-r5xr, affects App Router apps using Cache Components when a use cache function returns multiple typed arrays. Next.js says there is no known workaround and tells users to upgrade even if they have no similar functions. Netlify calls the triggering setup unusual and not expected in normally functioning applications, but says Netlify-hosted apps that match it are affected.

The second, GHSA-2464-fhr4-w9xw (CVE-2026-96889), is a memory-related bug in an upstream image library that can lead to code execution when Next.js runs on glibc-based Linux. Next.js says the interim workaround is to make sure sharp is version 0.35.5 or later, and that upgrading Next.js brings in a fixed sharp. Pantheon, a separate hosting vendor, reports the same patched versions and workaround.

The third issue, GHSA-p3m5-59mp-jv5r, is rated high. Crafted requests to apps using the App Router with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Pages Router apps, and apps without Server Actions, are not vulnerable.

Netlify's customer notice is where the picture differs. Netlify did not patch these flaws itself; it recommends customers upgrade next and redeploy. It also says the image path described in the advisory is served by its own Image CDN and is not exercised on Netlify. The same SVG flaw can be reached through next/og ImageResponse, which runs in customers' functions, but Netlify says the impact there is a crashed invocation rather than code execution. Netlify rates the Server Action denial of service as minimal on its platform, while warning that active exploitation could raise function costs. These are Netlify's own assessments; the other sources do not make them.

Netlify also warns that public deploy previews and branch deploys may stay vulnerable until they are automatically deleted, and suggests deleting them manually. Pantheon says customers are responsible for updating dependencies and redeploying, and that it does not update sites on their behalf.

What remains unclear is how widely the vulnerable configurations are used and whether exploitation has been seen; none of the three sources reports attacks. The practical takeaway is simple: anyone running Next.js on these lines should move to 15.5.28 or 16.4.1 and redeploy, whatever their host says about its own exposure.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. Correction: the earlier version said Netlify had patched the vulnerabilities and that the SVG flaw was a code-execution risk through next/og ImageResponse on Netlify. The source says the fixes are in Next.js 15.5.28 and 16.4.1, which customers must install and redeploy, and that on Netlify the ImageResponse path causes only a crashed function invocation, not code execution. The earlier version remains available as revision 1.