Next.js RCE Vulnerability: Upgrade to 16.4.1 or 15.5.28

A Next.js RCE vulnerability is a flaw that lets an attacker run their own code on the server that runs your Next.js app. On 14 October 2026 the Next.js team published an out-of-band security update that fixes two critical unauthenticated remote code execution vulnerabilities and one high-severity denial of service. The fixes ship in Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). If you run a headless storefront or any other Next.js app, upgrade now.

Next.js vulnerabilities fixed on 14 October 2026

The three issues, with the affected and fixed versions from each GitHub advisory:

The use cache and Server Actions issues have related upstream advisories in React, GHSA-xqc2-xf4c-x3h3 and GHSA-h3gv-c5rc-p453, which the Next.js team links from its announcement.

Is my Next.js app affected?

• use cache remote code execution: affects apps using the App Router with Cache Components when a use cache function returns multiple typed arrays. In the Next.js docs, use cache is a Cache Components feature that you turn on with the cacheComponents option in next.config. The advisory gives no workaround and tells you to upgrade even if your app has no such function.
• Image Optimization remote code execution: a memory-related bug in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux. The advisory's workaround is to make sure the sharp package Next.js uses is 0.35.5 or later. Upgrading Next.js makes package managers pull in a fixed sharp.
• Server Actions denial of service: crafted requests to an App Router app with at least one Server Action can drive CPU usage up and block further requests in the same process. Apps using the Pages Router, or not using Server Actions, are not vulnerable.

The Image Optimization advisory covers every release from 10.0.0 up to 15.5.27, so apps still on Next.js 14 or older are in range. The advisory lists fixes only on the 15.5 and 16.4 lines. On an older line, move to 15.5.28 or 16.4.1, or apply the sharp workaround until you can. Next.js 13 and 14 App Router apps with Server Actions are also in range of the denial of service advisory, which has no workaround besides upgrading.

How to patch Next.js

1. Check the installed versions. Run npm ls next sharp (or the equivalent for your package manager) in every app and build image.
2. Upgrade Next.js. Run npm install next@16.4.1 on the 16.4 line or npm install next@15.5.28 on the 15.5 line. The npm latest tag now points to 16.4.3, which is later than the fixed release.
3. Confirm sharp. After installing, check that the resolved sharp is 0.35.5 or later. If you cannot upgrade Next.js straight away, pin sharp to 0.35.5 or later as the advisory's interim workaround for the Image Optimization flaw.
4. Rebuild and redeploy. Commit the lockfile, rebuild every container and redeploy. A running server keeps the old code until it restarts.
5. Test the paths that changed. Check pages that use next/image, cached functions and Server Actions, such as cart and checkout forms, before you close the ticket.

Timeline

• 30 September 2026: the Next.js September security release. Two fixes were held back from it because of upstream dependency delays.
• 8 October 2026: the Next.js team pre-announced an out-of-band update for 14 October covering two critical and one high-severity issue.
• 14 October 2026: npm records 15.5.28 at 17:36 UTC and 16.4.1 at 17:43 UTC; the three GitHub advisories were published between 17:46 and 17:47 UTC.

What to do next

List every Next.js app you run, including preview and staging deployments, and move each one to 16.4.1 or 15.5.28 or later today. If the same stack runs Node.js or PHP, the Node.js Brotli RCE fix and the PHP2Shell vulnerabilities need the same treatment. Our ecommerce supply chain security checklist covers dependency pinning and patch routines. If you want a headless storefront upgraded and tested for you, our headless Shopify development team can scope it.

Related guide: Is my Next.js version vulnerable? How to check and fix.