Explore all React2Shell and framework vulnerability guides →
Next.js published an upstream-security update on October 14, 2026 covering two critical remote code execution issues and a high-severity denial of service issue. Its patched releases are 15.5.28 and 16.4.1. These are separate advisories from the December 2025 React2Shell disclosure.
Three issues with different affected configurations
- GHSA-673q-mjm6-r5xr: unauthenticated RCE in App Router applications with Cache Components involving use cache functions returning multiple typed arrays. Next.js says there is no known workaround and advises upgrading even without similar functions.
- CVE-2026-96889 / GHSA-2464-fhr4-w9xw: image optimization RCE involving an upstream library on glibc-based Linux. The advisory identifies sharp 0.35.5 or later as a workaround; patched Next.js releases pull in a fixed dependency.
- GHSA-p3m5-59mp-jv5r: excessive CPU use affecting App Router applications with at least one Server Action. The advisory excludes Pages Router applications and applications without Server Actions from this particular DoS issue.
Build a configuration inventory before declaring exposure
Collect the Next.js version, resolved image-processing dependencies, hosting runtime and router configuration from the deployed artifact. Document which applications use server actions, caching features and image optimization. A statement such as 'we use Next.js' is a starting point, not a complete affectedness assessment. Likewise, an exclusion for one issue does not establish that the other issues are irrelevant.
For teams with several environments, use one row per deployment: domain, owner, build identifier, relevant configuration, patch status and verification evidence. Include older previews that still receive traffic. This makes it easier to find the overlooked environment after the main production deployment has been updated.
Apply the update and prove it reached production
- Read the official advisory linked below and select a supported patched release appropriate to your application. Review migration requirements if your current branch is older.
- Update dependencies and the lockfile, then build a fresh deployment artifact. Inspect the resolved dependency tree rather than assuming the requested version was installed.
- Exercise image delivery, cached pages, sign-in and server actions in a representative environment. Record any compatibility issues and resolve them before completing the rollout.
- Deploy the patched artifact to every affected environment. Verify the deployment identifier that actually serves requests and remove obsolete exposed deployments through your normal release process.
- Monitor errors and resource usage after release. Save evidence of the installed versions and functional checks with the security ticket.
Does a clean scan mean my Next.js website is safe?
No single scan establishes that an application is free of vulnerabilities. A useful report identifies what was tested, what evidence was observed and what remained outside scope. Dependency evidence answers whether a vulnerable package is present; configuration review answers whether advisory conditions apply; runtime checks answer a narrower question about the tested behavior. Use the three together when deciding what to fix.
Keep patch verification separate from compromise assessment. If you have suspicious application behavior or evidence of unauthorized access, preserve the relevant records and investigate through your incident-response process. A successful deployment does not reconstruct past activity.
Run a MyPentest scan on your authorized website to review supported security checks and prioritize findings. Dedicated detection of these October 2026 Next.js advisories is not confirmed here. Verify these CVEs through the official advisory, your deployed dependencies and configuration review; a clean general scan is not a CVE clearance certificate.