Threat reportVulnerabilityTL-2026-3638
Next.js Out-of-Band Patch for Two Critical RCE Flaws (use cache GHSA-673q-mjm6-r5xr, SVG processing CVE-2026-96889 / GHSA-2464-fhr4-w9xw)
Next.js Out-of-Band Patch for Two Critical RCE Flaws (use (TL-2026-3638), also tracked as GHSA-673q-mjm6-r5xr, is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-10-15. It has no confirmed attribution, affects Vercel Next.js (use cache / Cache Components, GHSA-673q-mjm6-r5xr), references 2 CVEs (CVE-2026-96889, CVE-2026-94545), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1195.001), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3638
- Threat ID
- TL-2026-3638
- Also known as
- GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, GHSA-wq5f-xc86-pv6w, VectorFreed
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, ecommerce, news - media, finance, saas
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
Malware and tooling: VectorFreed
How Next.js Out-of-Band Patch for Two Critical RCE Flaws (use works
Next.js 16.4.1 and 15.5.28 fix two unauthenticated critical (CVSS v4.0 9.5) remote code execution flaws: one in `use cache` functions returning multiple typed arrays under App Router Cache Components (GHSA-673q-mjm6-r5xr), and one in Image Optimization SVG handling caused by a librsvg use-after-free reached through sharp on glibc Linux (CVE-2026-96889). A high-severity Server Actions CPU-exhaustion DoS (GHSA-p3m5-59mp-jv5r) was fixed in the same release. As of 2026-10-15 there are no public reports of in-the-wild exploitation of the three October 14 fixes.
On 2026-10-14 Vercel published an out-of-band Next.js security update (v16.4.1 Active LTS, v15.5.28 Maintenance LTS) carrying two fixes that were postponed from the September 2026 security release because of upstream dependency delays.
GHSA-673q-mjm6-r5xr (Critical, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N, 9.5): unauthenticated remote code execution in applications using the App Router with Cache Components when a `use cache` function returns multiple typed arrays. Per press reporting the root cause lies in the React Server Components transport (react-server-dom-webpack, -parcel and -turbopack 19.0.0-19.3.0) in rare cases where a response transports multiple typed arrays together with an attacker-controlled value; the related upstream React advisory is GHSA-xqc2-xf4c-x3h3. Affected: Next.js 16.0.0-16.4.0; fixed in 16.4.1. There is no known workaround, and the advisory says to upgrade even if the application has no similar functions. The advisory had no CVE or CWE assigned at the time of writing and credits eps1lon. No public PoC is reported.
CVE-2026-96889 / GHSA-2464-fhr4-w9xw (Critical per Vercel, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.5; Red Hat rates the librsvg CVE 7.8 under CVSS 3.1 and the sharp advisory GHSA-wq5f-xc86-pv6w rates 8.9 under CVSS 4.0): a use-after-free (CWE-416) in librsvg, the GNOME SVG rendering library bundled by sharp/libvips. Processing an SVG with nested XInclude whose included document declares an XML entity with the same name as one already registered causes entity_insert() to free an xmlEntity struct that the outer xmlCtxtParseEntity() call still references, giving a crash or potentially code execution. Next.js is exposed on glibc-based Linux when attacker-supplied SVG reaches sharp, notably with `dangerouslyAllowSVG` or `next/og` on the Node.js runtime. Affected: Next.js 10.0.0-15.5.27 and 16.0.0-16.4.0; fixed in 15.5.28 and 16.4.1, which pull sharp >= 0.35.5 (librsvg 2.63.2). Upstream librsvg fixes are 2.63.1 and 2.60.3. Workaround: ensure sharp >= 0.35.5, or block SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }). Credited finders: randomguy6407 and rafabd1 (Rafael B. Dias). The librsvg issue was made public 2026-09-23 and sharp was patched 2026-09-27.
GHSA-p3m5-59mp-jv5r (High): crafted requests to App Router applications with at least one Server Action cause excessive CPU usage that blocks further request processing in the same process (DoS). Affected 13.0.0-15.5.27 and 16.0.0-16.4.0; Pages Router apps and apps without Server Actions are not vulnerable. Related React advisory GHSA-h3gv-c5rc-p453.
Exploitation context: the Hacker News reports no public attacks as of 2026-10-15. A public PoC repository (rafabd1/VectorFreed) targets the librsvg bug and demonstrates command execution in specific downstream paths (including the separate September next/og flaw CVE-2026-94545 in Next.js 16.2.0-16.3.5 via a Satori escaping bug, and Ghost); no universal RCE PoC exists. CVE-2026-96889 is not in CISA KEV. No network IOCs (IPs, domains, hashes) have been published, so BeaconBeagle correlation was not applicable.
MITRE ATT&CK techniques used in TL-2026-3638
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools
Impact
T1499.004 Application or System Exploitation
Resource Development
Affected products and versions in Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
- Vercel — Next.js (use cache / Cache Components, GHSA-673q-mjm6-r5xr)
Vulnerable versions: 16.0.0 - 16.4.0
Fixed in: 16.4.1 - Vercel — Next.js (Image Optimization SVG, CVE-2026-96889)
Vulnerable versions: 10.0.0 - 15.5.27; 16.0.0 - 16.4.0
Fixed in: 15.5.28; 16.4.1 - Vercel — Next.js (Server Actions DoS, GHSA-p3m5-59mp-jv5r)
Vulnerable versions: 13.0.0 - 15.5.27; 16.0.0 - 16.4.0
Fixed in: 15.5.28; 16.4.1 - React — react-server-dom-webpack / react-server-dom-parcel / react-server-dom-turbopack
Vulnerable versions: 19.0.0 - 19.3.0 - Lovell Fuller (sharp) — sharp (npm)
Vulnerable versions: < 0.35.5
Fixed in: 0.35.5 - GNOME — librsvg
Vulnerable versions: < 2.63.1; < 2.60.3 (2.60 branch)
Fixed in: 2.63.1; 2.63.2; 2.60.3
Remediation for Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
Patches
- next@16.4.1
- next@15.5.28
- sharp@0.35.5 (librsvg 2.63.2)
- librsvg 2.63.1 / 2.60.3 upstream fixes
Immediate actions
- Upgrade Next.js to 16.4.1 (v16 line) or 15.5.28 (v15 line) and redeploy
- On v15 verify the installed sharp version is 0.35.5 or later
- Review exposure of dangerouslyAllowSVG and next/og (Node.js runtime) to attacker-supplied SVG content
Workarounds
- SVG flaw only: sharp.block({ operation: ["VipsForeignLoadSvg"] })
- SVG flaw only: ensure sharp >= 0.35.5 is used by Next.js
- No known workaround for the use cache RCE or the Server Actions DoS; upgrade is required
Longer-term hardening
- Pin and monitor transitive native dependencies such as sharp, libvips and librsvg
- Subscribe to Next.js, React and sharp advisories; note GHSA-673q and GHSA-p3m5 lacked CVEs and were absent from the npm advisory feed at publication
- Run image processing in sandboxed or low-privilege workers
CVEs associated with Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
Weaknesses (CWE) in Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
Timeline of Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
- Related Next.js next/og ImageResponse RCE (CVE-2026-94545, Satori escaping bug, 16.2.0-16.3.5) disclosed and fixed in 16.3.6.
- librsvg use-after-free CVE-2026-96889 made public; VectorFreed PoC repository demonstrates triggering via nested XInclude with duplicate entities.
- sharp patched upstream with a fixed librsvg, per The Hacker News; fix postponed in Next.js due to upstream dependency delays.
- Netlify published impact statement for the September Next.js security release (15.5.27 / 16.3.8), which excluded the two fixes later shipped out-of-band.
- sharp advisory GHSA-wq5f-xc86-pv6w (alias CVE-2026-96889) published; fixed in sharp 0.35.5 with librsvg 2.63.2.
- Microsoft CBL-Mariner/Azure Linux added a librsvg2 fix for CVE-2026-96889.
- Vercel released Next.js 16.4.1 and 15.5.28 fixing GHSA-673q-mjm6-r5xr, CVE-2026-96889 / GHSA-2464-fhr4-w9xw and GHSA-p3m5-59mp-jv5r.
- The Hacker News reports no public reports of in-the-wild exploitation of the three October 14 flaws and no PoC for the use cache flaw.
Sources cited for Next.js Out-of-Band Patch for Two Critical RCE Flaws (use
- Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
- Next.js Security Update for Upstream Vulnerabilities (October 14, 2026)
- GHSA-673q-mjm6-r5xr: Unauthenticated RCE in use cache functions returning typed arrays
- GHSA-2464-fhr4-w9xw / CVE-2026-96889: RCE in Image Optimization API with SVG
- GHSA-p3m5-59mp-jv5r: Server Actions DoS
- GHSA-wq5f-xc86-pv6w: sharp librsvg memory vulnerability (OSV)
- Debian Security Tracker: CVE-2026-96889 (librsvg use-after-free)
- Wiz Vulnerability Database: CVE-2026-96889
- VectorFreed: CVE-2026-96889 librsvg UAF PoC
- librsvg GNOME GitLab work item 1241
- Red Hat Bugzilla 2539279: CVE-2026-96889 librsvg
- Netlify: Security Update - Multiple vulnerabilities in Next.js (September release)
- Indusface: CVE-2026-94545 Next.js next/og RCE
Detection coverage for TL-2026-3638
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3638 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.