# Next.js Out-of-Band Patch for Two Critical RCE Flaws (use cache GHSA-673q-mjm6-r5xr, SVG processing CVE-2026-96889 / GHSA-2464-fhr4-w9xw)

> Next.js 16.4.1 and 15.5.28 fix two unauthenticated critical (CVSS v4.0 9.5) remote code execution flaws: one in `use cache` functions returning multiple typed arrays under App Router Cache Components (GHSA-673q-mjm6-r5xr), and one in Image Optimization SVG handling caused by a librsvg use-after-free reached through sharp on glibc Linux (CVE-2026-96889). A high-severity Server Actions CPU-exhaustion DoS (GHSA-p3m5-59mp-jv5r) was fixed in the same release. As of 2026-10-15 there are no public reports of in-the-wild exploitation of the three October 14 fixes.

- **Published:** 2026-10-15T16:03:23Z
- **Last reviewed:** 2026-10-15T16:03:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3638
- **ID:** TL-2026-3638
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96889, CVE-2026-94545

## Description

On 2026-10-14 Vercel published an out-of-band Next.js security update (v16.4.1 Active LTS, v15.5.28 Maintenance LTS) carrying two fixes that were postponed from the September 2026 security release because of upstream dependency delays.

GHSA-673q-mjm6-r5xr (Critical, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N, 9.5): unauthenticated remote code execution in applications using the App Router with Cache Components when a `use cache` function returns multiple typed arrays. Per press reporting the root cause lies in the React Server Components transport (react-server-dom-webpack, -parcel and -turbopack 19.0.0-19.3.0) in rare cases where a response transports multiple typed arrays together with an attacker-controlled value; the related upstream React advisory is GHSA-xqc2-xf4c-x3h3. Affected: Next.js 16.0.0-16.4.0; fixed in 16.4.1. There is no known workaround, and the advisory says to upgrade even if the application has no similar functions. The advisory had no CVE or CWE assigned at the time of writing and credits eps1lon. No public PoC is reported.

CVE-2026-96889 / GHSA-2464-fhr4-w9xw (Critical per Vercel, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.5; Red Hat rates the librsvg CVE 7.8 under CVSS 3.1 and the sharp advisory GHSA-wq5f-xc86-pv6w rates 8.9 under CVSS 4.0): a use-after-free (CWE-416) in librsvg, the GNOME SVG rendering library bundled by sharp/libvips. Processing an SVG with nested XInclude whose included document declares an XML entity with the same name as one already registered causes entity_insert() to free an xmlEntity struct that the outer xmlCtxtParseEntity() call still references, giving a crash or potentially code execution. Next.js is exposed on glibc-based Linux when attacker-supplied SVG reaches sharp, notably with `dangerouslyAllowSVG` or `next/og` on the Node.js runtime. Affected: Next.js 10.0.0-15.5.27 and 16.0.0-16.4.0; fixed in 15.5.28 and 16.4.1, which pull sharp >= 0.35.5 (librsvg 2.63.2). Upstream librsvg fixes are 2.63.1 and 2.60.3. Workaround: ensure sharp >= 0.35.5, or block SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }). Credited finders: randomguy6407 and rafabd1 (Rafael B. Dias). The librsvg issue was made public 2026-09-23 and sharp was patched 2026-09-27.

GHSA-p3m5-59mp-jv5r (High): crafted requests to App Router applications with at least one Server Action cause excessive CPU usage that blocks further request processing in the same process (DoS). Affected 13.0.0-15.5.27 and 16.0.0-16.4.0; Pages Router apps and apps without Server Actions are not vulnerable. Related React advisory GHSA-h3gv-c5rc-p453.

Exploitation context: the Hacker News reports no public attacks as of 2026-10-15. A public PoC repository (rafabd1/VectorFreed) targets the librsvg bug and demonstrates command execution in specific downstream paths (including the separate September next/og flaw CVE-2026-94545 in Next.js 16.2.0-16.3.5 via a Satori escaping bug, and Ghost); no universal RCE PoC exists. CVE-2026-96889 is not in CISA KEV. No network IOCs (IPs, domains, hashes) have been published, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation
- T1587.004 Exploits

## Sources

- [Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing](https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html)
- [Next.js Security Update for Upstream Vulnerabilities (October 14, 2026)](https://nextjs.org/blog/nextjs-security-update-october-14-2026)
- [GHSA-673q-mjm6-r5xr: Unauthenticated RCE in use cache functions returning typed arrays](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)
- [GHSA-2464-fhr4-w9xw / CVE-2026-96889: RCE in Image Optimization API with SVG](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw)
- [GHSA-p3m5-59mp-jv5r: Server Actions DoS](https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r)
- [GHSA-wq5f-xc86-pv6w: sharp librsvg memory vulnerability (OSV)](https://osv.dev/GHSA-wq5f-xc86-pv6w)
- [Debian Security Tracker: CVE-2026-96889 (librsvg use-after-free)](https://security-tracker.debian.org/tracker/CVE-2026-96889)
- [Wiz Vulnerability Database: CVE-2026-96889](https://www.wiz.io/vulnerability-database/cve/cve-2026-96889)
- [VectorFreed: CVE-2026-96889 librsvg UAF PoC](https://github.com/rafabd1/VectorFreed)
- [librsvg GNOME GitLab work item 1241](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)
- [Red Hat Bugzilla 2539279: CVE-2026-96889 librsvg](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)
- [Netlify: Security Update - Multiple vulnerabilities in Next.js (September release)](https://www.netlify.com/changelog/2026-09-30-nextjs-react-security-vulnerabilities/)
- [Indusface: CVE-2026-94545 Next.js next/og RCE](https://www.indusface.com/blog/cve-2026-94545-nextjs-rce/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3638