Guide · Next.js · v0 · Cursor · Updated 19 October 2026

Next.js October 2026 security update: CVE-2026-96889 and two more bugs, explained

On 14 October 2026, Next.js shipped 16.4.1 and 15.5.28 to fix three bugs, two of them rated critical. If an AI tool picked Next.js for you, through v0, Cursor or a starter template, you may not know which version your app is on, let alone whether these bugs reach it. This is the page we wanted when the advisories landed: what each one is, who it actually reaches, and how to check your own app in about ten minutes. We run Next.js 15.5 for LockShip, and while checking our own upgrade we found one detail on the 15 line that is easy to miss.

New to this? Start with our vibe coding security checklist, eleven checks for any AI-built app, whatever tool made it. This page goes deep on one release.

The short version

The Next.js team announced on 8 October that an out-of-band security update was coming, and published it on 14 October. The fixes are in 16.4.1 for the 16 line and 15.5.28 for the 15 line. There is no fix for 14 or older. If you are below those versions, upgrade.

The ranges are copied from the three GitHub advisories, including their odd edges: the image advisory’s 16 range starts just after 16.0.0, while the other two include it. The CVSS scores are the advisories’ own, version 4.0.

Check a version now

Type a Next.js version and this box tells you which of the three advisories cover it and where the fix is. It uses the same ranges as the table above. If you don’t know your version yet, check 1 below shows how to find the one your live site runs.

What each one is

1. Code execution through SVG images (CVE-2026-96889)

This one starts outside Next.js. RustSec and Red Hat describe a use-after-free in librsvg, the library that draws SVG files: an SVG with nested XML includes that declare an entity with a name already in use can make librsvg free memory the parser is still using. The CVE record was published on 23 September and says an attacker could use it to crash the program or run their own code.

Next.js resizes images with sharp, and sharp ships librsvg inside it. The sharp advisory says the bug can lead to remote code execution on glibc-based Linux, and that sharp 0.35.5, released on 27 September, brings the fixed librsvg 2.63.2. The Next.js advisory rates it critical, says it is unauthenticated remote code execution in the Image Optimization API when SVG files are used, and gives the same workaround: make sure the sharp that Next.js uses is 0.35.5 or later.

Three details from those advisories are worth knowing:

• It is about Linux with glibc. Debian and Ubuntu use glibc. Alpine uses musl instead, which is outside the condition both advisories name. macOS and Windows aren’t mentioned.
• How Node.js was built matters. The sharp advisory says a node binary compiled as a Position Independent Executable blocks the code execution path, that most Linux package managers build it that way, and that the official Node.js binaries do not.
• SVG optimization is off by default. The Next.js image docs say Next.js doesn’t optimize SVG images unless you set dangerouslyAllowSVG. The advisory doesn’t say whether that setting decides who is exposed, so we wouldn’t treat it as a reason to wait. If you do have it set to true, you are squarely in the case the title describes.

2. Code execution in “use cache” functions (Next.js 16 only)

The second advisory covers 16.0.0 to 16.4.0 and only apps on the App Router with Cache Components turned on. To be exposed, the app needs a use cache function that returns multiple typed arrays (things like Uint8Array). The upstream React advisory calls this “extremely rare.” Most apps won’t have such a function. There is no workaround, and the Next.js team says to upgrade even if your app has none.

3. A request that ties up your server (Server Actions)

The third advisory is rated high rather than critical. Crafted requests to an App Router app with at least one Server Action can use so much CPU that the process stops answering other requests. It covers 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0, and the upstream React advisory describes the same kind of attack on server functions. Apps on the Pages Router, or with no Server Actions, aren’t affected. AI builders reach for Server Actions a lot, so if your app has forms that save things, assume you have some until check 5 says otherwise.

Does it reach my app?

It depends on where and how the app runs. What the vendors themselves have said:

• Your own server or a Docker container. This is the case the image advisory is written for: Next.js running on Linux with glibc, resizing images with the sharp in your node_modules. Check 4 shows how to see both from the server.
• Netlify. Netlify’s changelog note says next/image there goes through Netlify Image CDN, not your function, so that path isn’t exercised. It says the same flaw can still be reached through next/og ImageResponse, which does run in your function, with the impact limited to a crashed invocation. It also reminds you that public deploy previews and branch deploys stay vulnerable until they are deleted.
• Vercel. For the August 2026 release, Vercel posted a changelog note saying apps on Vercel were protected with no action needed. We looked for an equivalent note for this release on 19 October and didn’t find one. Two of the three bugs are in how your app’s server handles requests, not in image handling, so the honest answer is: upgrade.
• A static export. With output: 'export' there is no Next.js server at run time. The static export docs list Image Optimization with the default loader and Server Actions as unsupported, and the React advisories say an app whose React code doesn’t use a server isn’t affected. Upgrade anyway, so you don’t carry the old version into the day you add a server.

Six checks for your own app

Everything here is read-only until check 6, and you only need a browser and a terminal in your project folder.

1. Find the version your live site runs
2. Find the versions in your project
3. Make sure sharp moved too
4. If you host it yourself, check the server
5. See which features your code uses
6. Upgrade, redeploy, and check again

next.version

npm ls next sharp

# A project whose lockfile was made with next 15.5.20 (July 2026)
$ npm ls next sharp
└─┬ next@15.5.20
  └── sharp@0.34.5

$ npm install next@15.5.28
$ npm ls next sharp
└─┬ next@15.5.28
  └── sharp@0.34.5      # still the vulnerable one

$ npm update sharp
$ npm ls next sharp
└─┬ next@15.5.28
  └── sharp@0.35.5      # fixed

// package.json: pin it, so no old lockfile can hold it back
"overrides": {
  "sharp": "0.35.5"
}

# Run these where the app actually runs (your server or container), in the app folder
node -e "const s=require('sharp');console.log(s.versions.sharp, s.versions.rsvg)"
ldd --version | head -1

# From your project folder: which of the three features does your code use?
ls -d app src/app 2>/dev/null          # an app folder means the App Router
grep -rnE --include='*.js' --include='*.jsx' --include='*.ts' --include='*.tsx' --include='*.mjs' \
  --exclude-dir=node_modules --exclude-dir=.next "[\"']use (server|cache)" .
grep -nE "cacheComponents|dangerouslyAllowSVG" next.config.*

Upgrade this project's next package to 16.4.1 if it is on Next.js 16, or to 15.5.28 if it is on 15 or older, and upgrade eslint-config-next to match. Then run "npm ls next sharp" and make sure sharp is 0.35.5 or later; if it is not, run "npm update sharp". Show me the old and new versions of next and sharp. Don't change anything else.

Where LockShip fits

We built LockShip because checks like number 1 are easy to forget once an app is live. You paste your app’s address and prove you own it. Among other things, the scan reads the Next.js version your deployed pages report and compares it with the advisories it knows by ID: the image optimizer one from this release, React2Shell and the middleware bypass. It doesn’t name the use cache and Server Actions advisories separately, but every version they cover is also inside one of those ranges, so an affected version won’t pass this check. It also counts the Server Actions your pages can call, without calling any.

What it can’t see matters just as much. It can’t read your sharp version, your server’s C library or how Node.js was built, so it tells you to check sharp yourself, which is check 3 and 4. It can’t tell whether you use Cache Components. It never sends requests designed to trigger a bug, so it proves nothing about whether a crafted request would work, only that your version is in the range. Today we also corrected our own scan’s advice: it used to say that upgrading Next.js pulls in the fixed sharp, which, as check 3 shows, isn’t always true on the 15 line.

The summary is free: a score and the single worst thing we found. The $39 Launch Safe certificate adds every finding with a fix prompt for your builder, a PDF and seven days of re-scans while you fix things, and a passing re-scan gives you a badge for your site. After that, Monitor re-scans about once a week for $9 a month, and the badge turns grey if a later scan finds a critical or high issue.

Questions people ask

Keep reading

• Vibe coding security checklist: what to check before you launch an AI-built app
• Is my v0 app secure? A plain check before you launch
• Is my Cursor app secure? A plain check before you launch
• Leaked API keys in your frontend bundle: how to find them and what to do
• A Supabase RLS checklist for vibe-coded apps

Sources

We checked each of these on 19 October 2026. Version ranges come from the GitHub advisories; the sharp behaviour in check 3 is from our own test with npm 11. Advisories get updated, so if anything here disagrees with them, trust the advisory and tell us at hi@lockship.dev.

• Next.js Security Update for Upstream Vulnerabilities, Next.js blog, 14 October 2026
• Upcoming Next.js Security Update, Next.js blog, 8 October 2026
• GHSA-2464-fhr4-w9xw, Image Optimization API and SVG, vercel/next.js
• GHSA-673q-mjm6-r5xr, use cache and typed arrays, vercel/next.js
• GHSA-p3m5-59mp-jv5r, Server Actions denial of service, vercel/next.js
• GHSA-xqc2-xf4c-x3h3, React Server Components, facebook/react
• GHSA-h3gv-c5rc-p453, Server Functions denial of service, facebook/react
• GHSA-wq5f-xc86-pv6w, librsvg in sharp, lovell/sharp
• sharp v0.35.5 release, lovell/sharp
• CVE-2026-96889, CVE record
• RUSTSEC-2026-0305, librsvg, RustSec
• CVE-2026-96889, Red Hat
• Next.js v15.5.28 release notes
• Next.js v16.4.1 release notes
• next@15.5.28 package.json
• next@16.4.1 package.json
• Image component, dangerouslyAllowSVG, Next.js docs
• Static exports, Next.js docs
• cacheComponents, Next.js docs
• use server, Next.js docs
• Next.js and React security release (Oct 2026), Netlify changelog
• Vercel applications are protected from Next.js August 2026 security vulnerabilities, Vercel changelog
• npm ls, npm docs
• npm update, npm docs
• overrides in package.json, npm docs