Next.js security update: two critical RCE flaws, plus Node.js patches

This Next.js security update fixes two critical flaws that can let an unauthenticated attacker run code on your server. Vercel shipped it on October 14, 2026. Node.js followed on October 21 with its own security releases, including a fix for a Brotli decoder flaw that CISA added to its Known Exploited Vulnerabilities catalogue on October 27. If you run either one in production, upgrade both now. Our code audit services cover this kind of dependency exposure.

What changed

Vercel released Next.js 16.4.1 and 15.5.28. The Node.js project released 26.12.1, 24.22.1 and 22.23.4. The two Next.js RCE flaws come first. The versions in this alert are correct as of October 30, 2026, and any later release on the same line also carries the fixes.

• use cache remote code execution: GHSA-673q-mjm6-r5xr is rated critical, CVSS 9.5. It affects App Router apps using Cache Components when a use cache function returns multiple typed arrays. It covers Next.js 16.0.0 to 16.4.0 and is fixed in 16.4.1. There is no known workaround, and the advisory says to upgrade immediately even if your app has no such function.
• Image Optimization remote code execution: GHSA-2464-fhr4-w9xw (CVE-2026-96889) is rated critical, CVSS 9.5. A memory flaw in an upstream library can lead to code execution when SVG files are used and Next.js runs on glibc-based Linux. It covers 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, fixed in 15.5.28 and 16.4.1.
• Server Actions denial of service: GHSA-p3m5-59mp-jv5r (CVE-2026-94482) is rated high, CVSS 8.2. Crafted requests to an App Router app with at least one Server Action can use enough CPU to block other requests. It has the same fixed versions.
• Node.js Brotli decoder: CVE-2026-111497 is rated high in the Node.js security release. An attacker who can supply Brotli data that your app decompresses with node:zlib can corrupt process memory. That can cause a crash, expose memory or lead to remote code execution. It affects the 26.x, 24.x and 22.x lines.
• Other Node.js fixes: the same release fixes more high-severity flaws in DNS resolution and TLS hostname checks. It also updates the bundled CA certificates after the eMudhra intermediate CA compromise.

CISA's Known Exploited Vulnerabilities catalogue lists the Google Brotli flaw. As of October 30, 2026, it lists neither Next.js critical flaw here.

Who is affected

• Next.js 16.0.0 to 16.4.0: all three Next.js flaws can apply.
• Next.js 15 before 15.5.28: the Image Optimization and Server Actions flaws can apply.
• Next.js 14 and older: the Image Optimization range reaches back to 10.0.0 and the Server Actions range to 13.0.0, and the patched releases are 15.5.28 and 16.4.1. Next.js lists 14.x and older as unsupported.
• Pages Router apps, or apps with no Server Actions, are not exposed to the denial of service flaw.
• Any Node.js service that decompresses Brotli data it does not fully trust. The Node.js project says end-of-life versions are always affected when a security release occurs.
• Python services using the brotli package below 1.2.1, which GitHub's advisory lists as affected by the same flaw.

What to do now

1. Check what is really deployed. Run npm ls next sharp and read node --version where the app runs, not on a laptop. A lockfile or a pinned base image can keep an old version in place.
2. Upgrade Next.js. Move to 16.4.1 or 15.5.28 or later, refresh the lockfile and redeploy.
3. Confirm the sharp version. The advisory names sharp 0.35.5 or later as the fix for the Image Optimization flaw. On an older Next.js line that cannot move yet, this is the only workaround, and it covers that flaw alone.
4. Upgrade Node.js. Move to 26.12.1, 24.22.1 or 22.23.4 or later, then rebuild every container image that bundles it.
5. Update Python services. Move brotli to 1.2.1 or later where you use it.
6. Review exposure. If a public app ran an affected version, check its logs for unusual requests and processes. Rotate secrets if anything looks wrong.

Key dates

1. October 14, 2026Next.js 16.4.1 and 15.5.28 released.
2. October 21, 2026Node.js security releases 26.12.1, 24.22.1 and 22.23.4 published.
3. October 27, 2026CISA added CVE-2026-111497 to its catalogue.
4. November 10, 2026the due date in CISA's catalogue for that entry. Treat it as an outer limit, not a target.

How we help with a Next.js security update

Bumping a version is the quick part. Knowing every service, image and lockfile picked it up takes a check. A code audit finds what you actually run and which fixes are missing. If you think an app has already been hit, bring in an emergency software developer through our crisis response service. Support dates for runtimes and frameworks sit in our software end-of-life tracker for startup stacks.