Developers building web applications with React and Next.js are being urged to check their dependencies after the Next.js team released security updates addressing two critical vulnerabilities that could allow attackers to execute code on vulnerable servers. The Cyber Security Agency of Singapore highlighted the risks in an alert dated October 20, 2026, assigning both issues CVSS 4.0 scores of 9.5 out of 10.
Two Critical Flaws Put Some Next.js Applications at Risk
The first vulnerability, tracked as GHSA-673q-mjm6-r5xr, affects certain applications using the Next.js App Router with Cache Components. Under a specific condition involving a “use cache” function that returns multiple typed arrays, an unauthenticated remote attacker could potentially execute code on the server. The Next.js team says affected applications should be upgraded even if developers do not believe they use the vulnerable function pattern.
The second issue, CVE-2026-96889, involves a memory-related vulnerability in an upstream library used by the Next.js Image Optimization API. It can create a remote code execution risk when Next.js runs on Linux systems using the glibc C library. The affected component is part of the image-processing path, making framework and dependency updates particularly important for teams operating production web services.
Which Next.js Versions Need an Update?
According to the official Next.js security advisory, patched releases include Next.js 16.4.1 and 15.5.28. The reported affected ranges include Next.js 16.x versions earlier than 16.4.1 and versions from 10.x through 15.x earlier than 15.5.28. Developers should consult the official advisory for the precise impact on their version and deployment configuration.
For projects on the relevant release lines, the Next.js team provides these upgrade commands:
- Next.js 16.4:
npm install next@16.4.1 - Next.js 15.5:
npm install next@15.5.28
Teams running other versions should not assume that these commands are suitable for every project. Check the official security notice, confirm the supported upgrade path, and test the updated application before deploying it to production. Review lockfiles and deployed dependency versions as well, since updating a local package does not automatically update a live server.
Why React and Full-Stack Developers Should Pay Attention
Next.js builds on React and supports server-side features that run outside the user's browser. A vulnerability in those server-side pathways can therefore have consequences beyond a broken user interface. Depending on the flaw and the application's configuration, successful remote code execution may expose the server process and its accessible resources to an attacker.
The advisory also describes a separate high-severity denial-of-service issue involving App Router applications that use at least one Server Action. Crafted requests can cause excessive CPU consumption and prevent the affected process from handling additional requests. The Next.js team says applications using the Pages Router or not using Server Actions are not affected by that particular denial-of-service issue.
Recommended Actions for Web Application Teams
Development and security teams should identify all deployed Next.js applications, verify their actual framework versions, and apply the appropriate patched release. They should also review whether their deployments run on glibc-based Linux systems and examine their image-optimization dependencies. The official advisory notes that using sharp version 0.35.5 or later is a workaround for the image-optimization vulnerability, but upgrading Next.js to a fixed version is the recommended approach.
After updating, teams should run their automated tests, rebuild production artifacts, redeploy affected services, and confirm that the running instances use the corrected dependencies. Organizations should prioritize internet-facing applications and maintain an inventory of older or unsupported projects that may need a separate remediation plan.
What This Means for the Next.js Ecosystem
The disclosure is a reminder that modern web frameworks depend on server-side components and upstream libraries as well as application code. Keeping React and Next.js applications secure requires more than reviewing JavaScript written by developers: framework releases, image-processing packages, server features, and deployment environments all need attention.
No claim that every Next.js website is exploitable is warranted from the advisory alone. The documented impact depends on the affected versions and, for some issues, specific framework features or operating-system conditions. Developers should use the official security notice to determine their exposure and prioritize installing the fixed versions.
