Key points
- Two critical flaws allow unauthenticated remote code execution in React Server Components and librsvg.
- Next.js 16.4.1 and 15.5.28 address these issues along with a high-severity denial-of-service vulnerability.
- Affected environments include App Router apps with Cache Components, Server Actions, or SVG optimization enabled.
Vercel issued an out-of-band security update on October 14 to address three vulnerabilities in its Next.js framework. The release patches two critical flaws that permit unauthenticated remote code execution and one high-severity denial-of-service issue. System administrators must assess their deployments against the affected version ranges immediately, as the flaws impact widely used LTS branches.
The remote code execution vulnerabilities carry CVSS scores of 9.5 each. One flaw exists within React Server Components, specifically affecting App Router applications that utilize Cache Components. The other resides in librsvg, an open-source library Next.js uses via the sharp package to process SVG images. Both issues allow attackers to execute arbitrary code on the server without prior authentication.
Context and background
The first code-execution flaw targets React Server Components, which run user-interface components on the server. According to the advisory, the issue arises in rare cases where responses transport multiple typed arrays alongside attacker-controlled values. In Next.js applications, this trigger occurs when a use cache function returns more than one typed array. Consequently, only version 16 apps enabling Cache Components are directly exposed to this specific vector.
The second flaw is a memory bug within librsvg. This library renders SVG images for Next.js through the bundled sharp package. Code execution is possible when Next.js operates on glibc-based Linux systems. By default, Next.js does not optimize SVG files. However, enabling the dangerouslyAllowSVG setting or using next/og for social-preview images on the Node.js runtime exposes the application to this vulnerability.
Who is affected
Next.js versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are vulnerable to the cache component flaw. The SVG processing flaw affects versions 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. A third vulnerability allows crafted requests to push server processes to full CPU usage in App Router apps with at least one Server Action. This denial-of-service issue disrupts request handling.
Next steps
Vercel has released fixes in Next.js 16.4.1 and 15.5.28. These versions correspond to the current Active and Maintenance long-term support releases. Administrators should upgrade to these versions or later. For the SVG flaw, ensuring sharp version 0.35.5 or later is also recommended. Vercel advises upgrading even if the application does not use the specific triggering functions, to ensure comprehensive protection.
Signals worth monitoring
Teams usually detect remote code execution attempts by reviewing web server access logs for unusual query parameters or large payload sizes. Monitor for sudden spikes in CPU utilization, which may indicate the denial-of-service vector or background exploitation. Check for new processes spawned by the web server user that are not part of standard deployment scripts. Look for outbound network connections from application servers to unknown external IP addresses, which often signal data exfiltration or command-and-control communication after initial access.
What to do and how to stay safe: Next.js
- Verify your current Next.js version against the affected ranges and apply the 16.4.1 or 15.5.28 update immediately.
- Audit your application configuration to see if dangerouslyAllowSVG is enabled or if next/og is used on Node.js.
- Review server logs for unauthorized process execution or unusual outbound traffic patterns that suggest compromise.
- Ensure the sharp package is updated to version 0.35.5 or later to mitigate the librsvg vulnerability.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Next.js versions are affected by the critical RCE flaws?
Versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected by the cache flaw, while 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected by the SVG flaw.
Is there a fix available for these vulnerabilities?
Yes, Vercel released patches in Next.js 16.4.1 and 15.5.28.
Does the SVG flaw affect all Linux systems?
According to the advisory, code execution via the librsvg flaw is possible specifically when Next.js runs on glibc-based Linux.
