Next.js 16.4.1 Fixed Two Critical RCEs on October 14, and GitHub Indexed Them Eight Days Later

Two unauthenticated remote code execution flaws in Next.js, each scored 9.5 on CVSS v4, were fixed in versions 15.5.28 and 16.4.1 on October 14, 2026. GitHub's global advisory database stamped the records on October 22, at 15:52 and 16:42 UTC, so anyone who tracks advisories rather than release notes saw them eight days after the patch.

Upgrade to 15.5.28 (the 15.x line) or 16.4.1 (the 16.x line). Both releases were published on the Next.js repository at 17:47 UTC on October 14 and also fix a high-severity denial of service in the App Router involving Server Actions (GHSA-p3m5-59mp-jv5r).

The two flaws and who is exposed

The records differ in who can reach them. The Image Optimization flaw starts at version 10.0.0 and spans two release lines. The use cache flaw is confined to 16.x.

	GHSA-2464-fhr4-w9xw	GHSA-673q-mjm6-r5xr
Component	Image Optimization API, SVG input	use cache returning typed arrays
Affected	10.0.0 to 15.5.27, 16.0.0 to 16.4.0	16.0.0 to 16.4.0
Fixed in	15.5.28, 16.4.1	16.4.1
CVE	CVE-2026-96889	None listed
Workaround	sharp 0.35.5 or later	None known

Both vectors read AV:N/AC:L/AT:P/PR:N/UI:N, meaning network reachable, low complexity, no privileges, no user interaction, with an attack-requirements flag (AT:P) set. That flag is the honest qualifier here: the score does not describe every Next.js app, only those meeting the preconditions below.

Image Optimization: glibc Linux and SVG

The advisory for GHSA-2464-fhr4-w9xw describes a memory flaw in an upstream image library that can lead to remote code execution when Next.js runs on glibc-based Linux. It does not name the library in its impact text. The workaround names sharp, the image processing package Next.js uses: ensure the installed version is 0.35.5 or later, and fresh installs get a fixed version automatically. The record classes the cause as CWE-1395, dependency on a vulnerable third-party component, and credits two finders, randomguy6407 and rafabd1.

The sharp project shipped 0.35.5 on September 27, seventeen days before the Next.js release. Its notes list bounds checks on linear and GIF delay arrays and a libvips bump to 1.3.4. They do not call any of it a security fix, and the advisory does not say which change closes the hole, so the link between the two is the advisory's workaround and nothing more.

use cache: no workaround

The advisory for GHSA-673q-mjm6-r5xr applies to App Router applications with Cache Components and a use cache function that returns multiple typed arrays. It is classed as CWE-502, deserialization of untrusted data, and credits a finder with the handle evolutionstorm.

The advisory states there is no known workaround for applications with such functions and tells operators to upgrade "even if your application does not have similar functions." The Image Optimization flaw covers more versions; this one is the harder to mitigate in place.

What the sources do not say

Neither record, the release notes nor CISA's catalog lists exploitation in the wild as of October 22. CISA's Known Exploited Vulnerabilities feed, version 2026.10.21, has no Next.js entry. The GitHub record for the Image Optimization flaw carries CVE-2026-96889; the use cache record has none, so scanners keyed to CVE identifiers may miss it until one is assigned.

The gap between October 14 and October 22 is the practical risk for teams that patch from advisory feeds. Teams on Next.js 15.x who cannot upgrade immediately should confirm which sharp their lockfile resolves, and anyone on 16.0.0 to 16.4.0 should treat 16.4.1 as the only fix. Related coverage of fast-moving disclosures includes OpenAI's PHP vulnerability claims and GitLab's second CVSS 10.0 patch.