Skip to content
COR Intelligence
Back to The Patch Wave
The Patch WaveThis weekFound by: people

Next.js websites: two serious flaws fixed on 14/10, separate from PHP2Shell

COR Solutions26 October 2026
5 min read1,260 words

Next.js fixed two serious flaws on 14/10/2026 that could let an attacker run code on the server behind a website. Not linked to PHP2Shell. Ask your developer whether your site is on Next.js 16.4.1 or later, or 15.5.28 or later if it is still on version 15.

  • Updated 27/10/2026: clearer version advice. On Next.js 16 you need 16.4.1 or later; on 15, 15.5.28 or later; versions 10 to 14 have no fix and must move up. Next.js gives each version two years of support from its first release, so version 15 (out 21/10/2024) is at the end of that period: plan the move to 16. A working test exploit for the use cache flaw has also been claimed (Brandefense, October 2026), not yet verified.
LinkedInXEmail
A developer uses a mouse at a bright workstation with a large monitor, silver laptop, mechanical keyboard, headphones and plants.

What happened

Next.js, the toolkit behind many modern websites and web apps, put out an emergency update on 14/10/2026. It fixes two flaws that could let a stranger run their own code on the server behind a site, plus one that can freeze a site with crafted requests. This is not PHP2Shell. It is different software and was fixed a week earlier. No attacks have been reported (The Hacker News, 15/10/2026), and it is not on the US government's known-exploited list. NHS England says a test exploit for the image flaw has been reported and expects attacks in future (19/10/2026). One of the two serious flaws sits in a shared image library, not Next.js's own code.

Does this affect you

Businesses whose website or web app was built with Next.js, mostly newer custom sites rather than WordPress. If you're not sure, ask whoever built it.

What to do

  1. Ask your developer: "Is our site on Next.js 16.4.1 or later (or 15.5.28 or later if it is still on version 15), and has it been rebuilt and redeployed?" Versions 10 to 14 have no fix of their own and need to move up.
  2. If your site runs on its own server rather than a platform like Vercel or Netlify, ask them to check this first.
  3. On version 15, ask them to confirm the image library "sharp" is 0.35.5 or later, as the upgrade alone may not pull it in.
  4. Next.js gives each version two years of support from its first release, and version 15 came out on 21/10/2024. If your site is on 15, ask for a plan to move it to 16.

Found by

People. The image flaw was found by security researcher Rafael B. Dias (named by The Hacker News) with a second researcher credited in the advisory, and his write-up doesn't mention Ai. The React advisory credits one researcher for the use cache flaw, who has published no write-up.

For developers

The three issues (Vercel advisories, 14/10/2026)

  • GHSA-673q-mjm6-r5xr, RCE in use cache functions returning multiple typed arrays. CVSS 4.0 9.5 (Vercel). Affects next >= 16.0.0, <= 16.4.0 with App Router and Cache Components. Fixed in 16.4.1. No workaround; Vercel says upgrade "even if your application does not have similar functions". Upstream React GHSA-xqc2-xf4c-x3h3: react-server-dom-webpack/parcel/turbopack 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0; fixed in 19.0.9, 19.1.10, 19.2.9, 19.3.1. React calls it "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value". No CVE as of 26/10/2026.
  • CVE-2026-96889 / GHSA-2464-fhr4-w9xw, RCE in the Image Optimization API via SVG, through librsvg in sharp, on glibc-based Linux. CVSS 4.0 9.5 (Vercel); the CVE itself is 7.8 CVSS 3.1 (Red Hat, local and user interaction). Affects next 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Fixed in 15.5.28 and 16.4.1. Workaround: sharp >= 0.35.5 (librsvg 2.63.2), or sharp.block({ operation: ["VipsForeignLoadSvg"] }) per the sharp advisory. THN notes Next.js only optimises SVGs with dangerouslyAllowSVG; the finder says a crafted image could "pass the framework's SVG rejection" and be handled as SVG. Treat it as reachable either way and upgrade. The same library path is reachable through next/og ImageResponse on the Node.js runtime.
  • CVE-2026-94482 / GHSA-p3m5-59mp-jv5r, DoS in App Router with at least one Server Action. CVSS 4.0 8.2 (Vercel). Affects 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Fixed in 15.5.28 and 16.4.1. Pages Router apps, or apps with no Server Actions, are not affected.

Version 15 sharp gotcha (THN, 15/10/2026): 15.5.28 still accepts sharp 0.34.x, so an in-place upgrade can leave the vulnerable sharp. Run npm ls sharp. 16.4.1 requires 0.35.5.

Scanners may miss it: THN says that on 15/10 the use cache and Server Actions advisories had no CVE and weren't in the npm audit feed. GitHub added all three to its global database on 22/10/2026.

Hosting differences

  • Self-hosted (Node server, Docker, VPS on glibc Linux): exposed to each of the three until upgraded, wherever its conditions apply (Cache Components, Server Actions, glibc Linux). The image RCE needs glibc Linux; the sharp advisory adds that a Node binary built as a Position Independent Executable helps, and warns that "the 'official' Node.js binaries do not" use it.
  • Netlify (its changelog, 14/10/2026): /_next/image is served by Netlify Image CDN, so that path is "not exercised on Netlify"; next/og ImageResponse with untrusted input is affected but limited to "a crashed function invocation, not code execution". The use cache RCE is affected there. Old deploy previews stay vulnerable until deleted.
  • Vercel: I found no Vercel statement for this release saying hosted sites are shielded (Vercel did publish one for its August release). Don't claim Vercel-hosted sites are protected. Upgrade and redeploy, and remove old preview deployments.

Exploitation: none reported (THN, 15/10/2026; pwn.watch, updated 23/10/2026). Not on CISA KEV (catalogue 2026.10.26, re-checked 27/10/2026). Brandefense says "A public repository created on 17 October 2026 claims to hold a working proof of concept" for the use cache flaw, adding "We did not run the code and cannot confirm these claims." NHS England (19/10/2026): a PoC has been reported for CVE-2026-96889 and "future exploitation of this vulnerability is likely". The finder's repo has a UAF PoC generator and points to a public EQSTLab exploit for the related September next/og flaw CVE-2026-94545 (fixed in 16.3.6), "for its pinned Node.js/Sharp build". No NCSC alert for this found on 26/10/2026 (re-checked 10:59 GMT); NCSC's only Next.js item found is the March 2025 middleware one.

Who found it, and Ai

  • SVG/librsvg: advisory credits rafabd1 and randomguy6407 as finders. Rafael B. Dias (@rafabd1) writes: "a use-after-free I (@rafabd1) found in librsvg". His write-up doesn't mention Ai. Tag: People.
  • use cache: React advisory credits evolutionstorm as finder. No write-up found.
  • Server Actions DoS: no credit listed.
  • Overall tag: People. Don't upgrade it to Ai.

Link to PHP2Shell: none found. PHP2Shell is in the PHP engine (Calif, Wiz and OpenAI, Ai-assisted, fixed 21/10). These are in Next.js, React and librsvg, from different finders, fixed 14/10. The only Vercel and PHP2Shell link is Vercel's own PHP2Shell bulletin: Vercel added WAF rules for PHP functions and PHP backends proxied through Vercel. That covers PHP apps on Vercel, not Next.js.

Older Next.js CVEs: no evidence found that React2Shell (CVE-2025-55182, on KEV since 05/12/2025) or CVE-2025-29927 is being newly re-exploited this week. Not part of this item.

Sources

Read next

More from The Patch Wave