Next.js Security Update October 2026: Patch the use cache RCE, SVG sharp RCE and Server Actions DoS
The Next.js security update of October 14, 2026 fixes three vulnerabilities: two critical unauthenticated remote code execution (RCE) bugs, one in use cache and one in SVG image optimization through sharp , and a high severity denial of service in Server Actions. Upgrade to Next.js 16.4.1 or later on 16.x, or 15.5.28 on 15.x, make sure sharp is 0.35.5 or later , then rebuild and redeploy. The…
The October 14, 2026 Next.js security update addressed three vulnerabilities: two critical unauthenticated remote code execution (RCE) flaws, one in use cache and one in SVG image optimization via sharp, along with a high severity denial of service (DoS) issue in Server Actions. To resolve these issues, upgrade to Next.js 16.4.1 or later for 16.x versions, or 15.5.28 for 15.x versions, ensuring that sharp is updated to version 0.35.5 or later.
After applying the patch, rebuild and redeploy your application. Ensure that you check the installed versions of Next.js and sharp using npm ls next sharp to confirm they meet the required versions. The two RCE vulnerabilities carry a CVSS score of 9.5, making them highly critical, while the DoS issue is rated as high severity with an 8.2 CVSS score.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
