Next.js and React vulnerabilities: who the October patches affect

If your website or online store runs on Next.js, important security fixes for it came out in October. On 14 October 2026 the Next.js team released versions 16.4.1 and 15.5.28, which close three vulnerabilities. Two of them can allow an outsider to run their own code on the server without logging in. On the same day, React fixes also came out for websites that use React Server Components.

Not every Next.js website is exposed, and many business owners don’t even know what their website is built on. Below I explain who these vulnerabilities affect, how to check the version without a developer, what to do today and what to ask your contractor to do. As of 30 October 2026. Patched versions may change, so check them on the Next.js blog before updating.

What happened on 14 October

Next.js is a popular framework for building websites and stores in React, developed by Vercel. On 14 October the team released a security update outside the regular schedule. The announcement on the Next.js blog describes three bugs:

• Image optimization and SVG files (CVE-2026-96889). The bug lies in the librsvg library used by sharp, the tool that resizes images on the server. On Linux with the glibc library, a crafted SVG file can lead to remote code execution. Severity: critical.
• “use cache” functions (GHSA-673q-mjm6-r5xr). Affects only Next.js 16 with Cache Components enabled. When a function with the use cache directive returns several typed arrays, an unauthenticated attacker can run code on the server. There is no workaround. Severity: critical.
• Server Actions (GHSA-p3m5-59mp-jv5r). Crafted requests can load the processor so heavily that the website stops responding (a DoS attack). Severity: high.

Both critical vulnerabilities have a score of 9.5 out of 10 on the CVSS 4.0 scale in the GitHub advisories. Singapore’s Cyber Security Agency (CSA), in an alert of 20 October, recommends updating immediately. Vercel doesn’t mention attacks in its announcement, and CVE-2026-96889 is not in the CISA KEV catalog, the US list of vulnerabilities exploited in attacks (as of 29 October 2026). This is a good moment to patch your website calmly rather than in a rush.

Who these vulnerabilities affect

In short: they affect websites where Next.js runs on the server, that is, where it prepares pages or images at the moment a customer visits.

For the “use cache” vulnerability, Next.js recommends updating even if the project has no such functions. A Next.js website gets the React fixes together with the Next.js update, because the framework has its own copy of these packages. Projects that use React Server Components in another tool, for example React Router or Waku, update them separately.

What these vulnerabilities don’t affect:

• websites on WordPress, WooCommerce, Shoper and other systems without Next.js,
• applications in React alone without a server (for example, built with Vite): the React team says outright that code without a server is not exposed,
• statically exported Next.js websites (output: 'export'). The hosting then holds only HTML, CSS and JavaScript files, and a static export doesn’t support Server Actions or the default image optimization. Update such a website anyway the next time it’s rebuilt.

Watch out for old versions. According to the Next.js support policy, the 14.x and older lines no longer receive updates, and the October patches were released only for 15.5 and 16.4. A website on Next.js 14 needs to move to a newer line. Line 15 is to receive security fixes until 31 January 2027, so it’s worth planning the move to 16 now.

Vercel, Netlify or your own server

• Your own server (VPS, Docker, hosting with Node.js). This is where the risk is highest, because images are processed by your server, usually running Linux. The popular Debian and Ubuntu systems use glibc.
• Netlify. In its announcement of 14 October, Netlify writes that images from next/image are handled by its own Image CDN service, so the SVG vulnerability doesn’t work that way. The “use cache” vulnerability does, however, also affect websites on Netlify. Netlify recommends updating and removing public previews of old deployments (deploy previews), because they may remain vulnerable.
• Vercel. I haven’t found a Vercel announcement saying that the platform itself protects projects against these vulnerabilities (for the August release there was such an announcement). So assume the project has to be updated and redeployed.

How to check whether your website is exposed

Method 1: the browser (2 minutes)

1. Open your website in Chrome or Edge on a computer.
2. Press F12 (or right-click and choose Inspect), and then open the Console tab.
3. Type next.version and press Enter.

If a number appears, for example "16.4.0", the website runs on Next.js and you know its version. Version 16.4.1 or higher or, in line 15, 15.5.28 or higher means that the October patches are in place. Compare the numbers between the dots separately: 15.5.3 is an older version than 15.5.28. When the console shows the error “next is not defined”, the website is most likely not built on Next.js.

This method won’t tell you whether the website uses “use cache” or Server Actions, or which version of sharp the server has. Your contractor knows that.

Method 2: project files

If you have access to the repository (for example on GitHub), open the package.json file and find the line with "next". The notation ^16.4.0 means a range, and the exact version is shown in the lock file: package-lock.json, pnpm-lock.yaml or yarn.lock. A developer will check everything with one command:

npm ls next sharp

Method 3: the hosting panel

On Vercel and Netlify, open the latest deployment and its build logs. At the start of the build, Next.js prints a line with the version, for example “▲ Next.js 16.4.1”. Check the production deployment, not just a test one.

What to do today

1. Find out whether the website is built on Next.js and in which version. Method 1 or a question to your contractor is enough.
2. Make a backup of the code and data. I describe how to do it properly in the guide on backups and the 3-2-1 rule.
3. Update Next.js to at least 16.4.1 (line 16) or 15.5.28 (line 15). At the end of October the latest version was 16.4.3 of 23 October.
4. Check sharp. It should be version 0.35.5 or newer. Next.js 15.5.28 still allows the older sharp 0.34 branch, so after updating make sure what actually got installed.
5. Build and deploy the website from scratch, and then click through the most important places: the form, the cart, login, the photo gallery.
6. Plan the next update. Next.js has announced a scheduled security release for 3 November with fixes for seven medium-severity vulnerabilities. When it comes out, repeat steps 2–5.

Commands for the person who deploys the website:

npm install next@16.4.1   # line 16 (or a newer 16.4.x)
npm install next@15.5.28  # line 15
npm ls sharp              # expected: 0.35.5 or newer

If the website is on 16.0–16.3, moving to 16.4.1 is more than a minor fix and requires testing before deployment. If that will take longer, a temporary workaround for the image vulnerability is to force sharp 0.35.5 or newer. There is no workaround for the “use cache” vulnerability.

What to ask your host or contractor to do

The host usually updates the system and Node.js, but not your application’s packages. Next.js and sharp are part of the project, so they are updated by the website contractor or the person with access to the code and deployments. It’s best to have who is responsible for what written down in the website development contract.

A message to copy:

Hello, In connection with the Next.js security update of 14 October 2026, please provide:

1. information on which versions of Next.js and sharp our website runs on (production, test version and previews),
2. an update to at least 16.4.1 or 15.5.28 and confirmation of the version after deployment,
3. information on whether the website uses image optimization, Server Actions and “use cache”,
4. an update plan for after the Next.js security release announced for 3 November.

Please reply by [date]. Thank you.

If your contractor replies that the website “doesn’t use SVG”, ask for details. By default Next.js doesn’t optimize SVG files, and some analyses link the risk to the dangerouslyAllowSVG option being enabled. The official announcement doesn’t narrow it down that way, though, so it’s no reason to postpone the update.

Next.js runs on Node.js, so while you’re at it, also ask for the Node.js version to be checked. I describe this in the guide on the Node2Shell vulnerability (CVE-2026-111497) in Node.js and Brotli.

If you no longer have contact with your contractor, I can take over the website as part of technical maintenance. The Watch plan (from PLN 149 net a month) means monitoring, backups, security updates and a response within 2 business days. Standard (from PLN 349) and Pro (from PLN 749) add work hours and a faster response, in Pro down to 4 hours.

How not to miss future patches

Since July 2026, Next.js has been releasing security fixes on a fixed schedule and announcing them a few days in advance. For serious vulnerabilities it also releases them out of band, as on 14 October. Three habits are enough:

• Follow the security advisories for Next.js on GitHub (Security Advisories) or the Next.js blog.
• Enable Dependabot in the project repository. It will itself propose updates to packages in which vulnerabilities have been found.
• Agree on a response time with your contractor, for example installing a fix for a critical vulnerability within 48 hours of its release.

Summary

The October vulnerabilities affect websites where Next.js runs on the server: with image optimization, Server Actions or “use cache”. Check the version in the browser, ask your contractor to update to 16.4.1 or 15.5.28 (or newer) with written confirmation, and don’t forget the 3 November release. If you would rather have someone do it for you, write to me: I will check the versions and update the website, and for a larger project I will do a security audit. I build new Next.js websites as part of the Custom-built website service.