Next.js Security Update: Fix RCE and DoS in 15.5.28

If you run a Next.js website, you need to update to version 15.5.28 or 16.4.1 immediately to patch critical security flaws that allow attackers to crash your site or run malicious code.

This guide is for developers and website owners running Next.js applications. You will get a plain-English breakdown of the four security advisories released on October 22, 2026. We will cover exactly what these vulnerabilities do, how to check if your site is exposed, and the exact commands you need to secure your application right now.

The October 2026 Next.js Security Advisories

On October 22, 2026, four security advisories were published in the GitHub Advisory Database for the next npm package. Two of these are rated Critical, one is High, and one is Medium severity.

These vulnerabilities affect both the Next.js 15.x and 16.x release lines. If you are wondering is my website hackable, running an outdated version of Next.js with these specific features enabled is a significant risk.

Here is a quick summary of the four vulnerabilities before we dive into the details.

1. Image Optimization Remote Code Execution (Critical)

The first critical advisory (GHSA-2464-fhr4-w9xw) involves the Next.js Image Optimization API.

Remote Code Execution (RCE) is one of the most dangerous types of vulnerabilities. It means an attacker can execute their own commands on your server. In this case, the flaw exists in an upstream library used for optimizing images when SVG files are processed. This specific vulnerability can lead to possible RCE when Next.js runs on a glibc-based Linux system (which includes popular server operating systems like Ubuntu and Debian).

This affects older major versions as well. If you are running any version from 10.0.0 up to 15.5.27, or 16.0.0 up to 16.4.0, you are in the affected range.

The Workaround: The vulnerability is tied to the sharp image processing library. The advisory states that making sure the version of sharp used by Next.js is greater than or equal to 0.35.5 will mitigate the issue. Fresh installs of the patched Next.js versions automatically pull in a safe version of sharp.

2. Cache Typed Arrays Remote Code Execution (Critical)

The second critical advisory (GHSA-673q-mjm6-r5xr) affects applications using the App Router with Cache Components.

If your application uses a use cache function that returns multiple typed arrays, it can be exposed to remote code execution. Unlike the image optimization flaw, this one only affects the 16.x line (specifically versions 16.0.0 through 16.4.0). Versions in the 15.x line are not affected by this specific advisory.

The Workaround: There is no known workaround for this issue. The official advisory instructs developers to upgrade immediately, even if your application does not currently have functions returning multiple typed arrays.

3. Server Actions Denial of Service (High)

The third advisory (GHSA-p3m5-59mp-jv5r, assigned CVE-2026-94482) is a Denial of Service (DoS) vulnerability in the App Router.

Denial of Service means an attacker sends specific, crafted requests to your server to overwhelm it. In this case, sending crafted requests to an application using the App Router with at least one Server Action causes excessive CPU usage. This CPU spike blocks the server from processing further requests in the same process, effectively taking your site offline for real visitors.

This affects versions 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0. If your application only uses the older Pages Router, or if it does not use Server Actions at all, you are not vulnerable.

The Workaround: There is no workaround besides upgrading Next.js.

4. Cache Leak in Nested Functions (Medium)

The final advisory (GHSA-h694-7cp9-m8p3, assigned CVE-2026-103004) is a medium-severity data leak.

If you have Cache Components enabled, cached data can leak across root parameter values in nested use cache functions. This only affects a narrow band of versions: 16.3.0 up to 16.3.7. It was first patched in 16.3.8, but updating to 16.4.1 covers this fix as well.

How to Check Your Next.js Version

You cannot rely solely on your package.json file to tell you what version of Next.js is actually running in production. The package.json file often uses a caret (like ^15.0.0), which means your lockfile dictates the exact installed version.

To find out exactly what version you are running, open your terminal and run one of the following commands based on your package manager.

If you use npm:

npm ls next

If you use pnpm:

pnpm why next

If the output shows a version between 10.0.0 and 15.5.27, or between 16.0.0 and 16.4.0, you need to update immediately. Do not ignore this if you are on Next.js 15. The Image Optimization and Server Actions advisories cover version 15.5.27 and older.

You should also check your installed version of the sharp library:

npm ls sharp

If your sharp version is lower than 0.35.5, you are vulnerable to the Image Optimization RCE.

How to Fix These Vulnerabilities

The fix for all four advisories is to update your Next.js package and ensure your sharp dependency is up to date.

Step 1: Update Next.js

If you are on the Next.js 15 release line, update to version 15.5.28:

npm install next@15.5.28

If you are on the Next.js 16 release line, update to version 16.4.1:

npm install next@16.4.1

Step 2: Pin the Sharp Library

To be absolutely certain you are protected against the Image Optimization RCE, you should explicitly pin the sharp library to a safe version. Run this command to install version 0.35.5 or higher:

npm install sharp@^0.35.5

Never use an unquoted < or > symbol in your terminal when installing packages, as the terminal will misinterpret it as a file redirect.

Step 3: Rebuild and Redeploy

Once your package.json and lockfile are updated, you must rebuild your application and deploy it to your server.

npm run build

After deploying, it is highly recommended to re-run your automated test suite and manually check your core pages to ensure the update did not introduce any breaking changes to your layout or server actions.

Our Experience at Bug Circuit

At Bug Circuit, we believe in being transparent about security. Our own website runs on Next.js 15. Before these advisories were published, we were running Next.js version 15.5.22 with the sharp image library at version 0.35.3.

Because our /_next/image endpoint was enabled, we were inside the affected range of the Image Optimization advisory (even though our site's own pages use plain HTML img tags instead of the Next.js image component).

On October 22, 2026, just a few hours after the advisories appeared on GitHub, we took action. We updated our application to Next.js 15.5.28 and pinned sharp to 0.35.5. We rebuilt the application and switched over with a rolling reload. This ensured the site stayed online for our visitors while instantly patching the vulnerabilities.

Updating quickly is the best defense. If you have ever had a website hacked, you know the cleanup process is much more painful than a simple version bump.

Key Takeaways

• Check your version immediately. Run npm ls next to see your exact installed version. Do not rely on package.json alone.
• Update to the patched releases. Move to 15.5.28 (if you are on Next.js 15) or 16.4.1 (if you are on Next.js 16).
• Secure your image optimization. Run npm install sharp@^0.35.5 to ensure your image processing library is safe from the Critical RCE vulnerability.
• Rebuild and redeploy. The fix is only active once your newly built code is live on your production server.

Keeping dependencies updated is just one part of website security. Automated scanners often miss business-logic flaws and complex configuration errors. If you want a real human security engineer to hand-audit your website and provide a full written report of every vulnerability with exact fixes, check out our $49 Circuit manual audit. It is a straightforward, honest review of your site's security with no enterprise sales calls.