# Next.js patches critical code execution flaws in caching and image rendering

_Published Thursday, October 15, 2026 at 10:47 AM EDT · Security, Infrastructure · Latest · Tier 1 — Major_

![Next.js patches critical code execution flaws in caching and image rendering — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9mXutJ2QPpC1NUCUZWdHjUDUGPSD3DaDY4b-T1EXbg07sNWADsV43EvUacKzn4Ohp2bRbD93t8kXBpv513XdMZEnMh8eNkY1bBaSuGICWbituq_jgWNCjQa_Cq6Ur0jInsfEwsHfdInKq4Tcp2kmfuYoCIMrgWcWwtzFlRPePDpW9gwemIkQpJXEVaHU/s1700-nu-rw-lo-l85-e365/nextjs-rce.jpg)

Next.js released an emergency security update on October 14 fixing two critical flaws that allow unauthenticated remote code execution and a high-severity denial-of-service flaw. Fixes ship in versions 16.4.1 and 15.5.28.

The caching flaw affects version 16 applications using Cache Components under narrow conditions. The image flaw involves SVG rendering through sharp on glibc-based Linux. The denial-of-service flaw affects App Router applications with Server Actions.

Administrators should rebuild and redeploy after upgrading. Version 15 upgrades can retain vulnerable sharp 0.34.x, requiring a separate check and update to 0.35.5 or later. As of October 15, there were no public reports of attacks exploiting these three flaws.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html)
- [The Hacker News](https://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html)

---
Canonical: https://techandbusiness.org/newswire/o8x3X9RyfCEsJv2abXi4Rw
Published: 2026-10-15T14:47:42.827Z
Story chronology: 2026-10-14T00:00:00.000Z
Retrieved: 2026-10-15T17:40:49.275Z
Publisher: Tech & Business (techandbusiness.org)