Next.js patches critical code execution flaws in caching and image rendering

Next.js released an emergency security update on October 14 fixing two critical flaws that allow unauthenticated remote code execution and a high-severity denial-of-service flaw. Fixes ship in versions 16.4.1 and 15.5.28. The caching flaw affects version 16 applications using Cache Components under narrow conditions. The image flaw involves SVG rendering through sharp on glibc-based Linux. The denial-of-service flaw affects App Router applications with Server Actions. Administrators should rebuild and redeploy after upgrading. Version 15 upgrades can retain vulnerable sharp 0.34.x, requiring a separate check and update to 0.35.5 or later. As of October 15, there were no public reports of attacks exploiting these three flaws.