Vercel Patches Critical RCE and DoS Flaws in Next.js
Vercel has released an emergency security update for Next.js, addressing two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) bug. The patches were delayed from the September 2026 security release due to upstream dependency issues but are now available in Next.js v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS).
The first critical flaw, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), resides in the Image Optimization API and is triggered via SVG processing. The vulnerability stems from a memory-related issue in an upstream library, enabling unauthenticated RCE on glibc-based Linux systems. Since the flaw is unauthenticated and affects a commonly exposed feature, it poses a significant risk. Alpine and musl-based environments are not confirmed as affected, but teams are advised to verify their base images. A workaround involves ensuring the sharp library is updated to v0.35.5 or later, though upgrading Next.js automatically applies the fix.
The second critical RCE flaw impacts applications using the App Router with Cache Components, where a use cache function returning multiple typed arrays can lead to unauthenticated exploitation. No workaround exists, and Vercel urges immediate upgrades. A related advisory (GHSA-xqc2-xf4c-x3h3) has been issued for React.
The high-severity DoS vulnerability affects App Router applications with Server Actions, where crafted requests can trigger excessive CPU usage, blocking other processes. A related React advisory (GHSA-h3gv-c5rc-p453) has been published. Pages Router applications or those without Server Actions are unaffected.
Vercel recommends updating via:
npm install [email protected](for v15.5)npm install [email protected](for v16.4)
Security teams should verify sharp versions in lockfiles, audit applications using Cache Components or Server Actions, monitor image optimization endpoints for suspicious SVG requests, and redeploy containers to ensure patched dependencies are applied. While no active exploitation has been reported, the widespread use of Next.js in production environments heightens the urgency of patching. Vulnerability reports can be submitted via Vercel’s HackerOne bug bounty program.
Source: https://gbhackers.com/nextjs-svg-image-processing-vulnerability/
Vercel cybersecurity rating report: https://www.rankiteo.com/company/vercel
"id": "VER1792067304",
"linkid": "vercel",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Next.js users in production '
'environments',
'industry': 'Technology/Cloud Services',
'name': 'Vercel',
'type': 'Company'}],
'attack_vector': ['Unauthenticated exploitation via SVG processing',
'Unauthenticated exploitation via Cache Components',
'Crafted requests to Server Actions'],
'customer_advisories': 'Next.js users urged to update to patched versions '
'immediately',
'data_breach': {'file_types_exposed': ['SVG']},
'description': 'Vercel has released an emergency security update for Next.js, '
'addressing two critical remote code execution (RCE) '
'vulnerabilities and one high-severity denial-of-service (DoS) '
'bug. The patches were delayed from the September 2026 '
'security release due to upstream dependency issues but are '
'now available in Next.js v16.4.1 (Active LTS) and v15.5.28 '
'(Maintenance LTS).',
'impact': {'operational_impact': 'Excessive CPU usage blocking other '
'processes',
'systems_affected': ['Next.js applications using Image '
'Optimization API',
'Next.js applications using App Router with '
'Cache Components',
'Next.js applications using Server Actions']},
'investigation_status': 'Patches released, no active exploitation reported',
'post_incident_analysis': {'corrective_actions': ['Patch Next.js',
'Update sharp library',
'Audit vulnerable '
'components',
'Monitor for exploitation'],
'root_causes': ['Memory-related issue in upstream '
'library (Image Optimization API)',
'Vulnerability in Cache Components '
'(App Router)',
'Excessive CPU usage in Server '
'Actions']},
'recommendations': ['Update Next.js to patched versions',
'Verify sharp library versions',
'Audit applications for vulnerable components',
'Monitor for suspicious activity',
'Redeploy containers with patched dependencies'],
'references': [{'source': 'Vercel Security Advisory'},
{'source': 'GitHub Advisory (GHSA-2464-fhr4-w9xw)'},
{'source': 'React Advisory (GHSA-xqc2-xf4c-x3h3)'},
{'source': 'React Advisory (GHSA-h3gv-c5rc-p453)'}],
'response': {'communication_strategy': 'Security advisories published via '
'GitHub and React',
'containment_measures': 'Patches released in Next.js v16.4.1 and '
'v15.5.28',
'enhanced_monitoring': 'Monitor image optimization endpoints for '
'suspicious SVG requests',
'remediation_measures': ['Update to Next.js v16.4.1 or v15.5.28',
'Verify sharp library is updated to '
'v0.35.5 or later',
'Audit applications using Cache '
'Components or Server Actions',
'Monitor image optimization endpoints '
'for suspicious SVG requests',
'Redeploy containers to ensure patched '
'dependencies']},
'stakeholder_advisories': 'Security teams advised to verify sharp versions, '
'audit applications, and monitor endpoints',
'title': 'Vercel Patches Critical RCE and DoS Flaws in Next.js',
'type': ['Remote Code Execution (RCE)', 'Denial-of-Service (DoS)'],
'vulnerability_exploited': ['CVE-2026-96889 (GHSA-2464-fhr4-w9xw)',
'GHSA-xqc2-xf4c-x3h3 (React advisory)',
'GHSA-h3gv-c5rc-p453 (React advisory)']}