Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js releases patch for two critical RCE flaws in caching and SVG processing.
Run Vercel?
Get an email when a reviewed story names Vercel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Next.js has released an out-of-band security update addressing two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service flaw. The RCE flaws affect React Server Components and the librsvg library used for SVG processing, with CVSS scores of 9.5. The update is available in Next.js versions 16.4.1 and 15.5.28.
The lesson from this incident
Full lessonTwo critical remote code execution vulnerabilities (CVSS 9.5) were discovered in Next.js, affecting React Server Components and the third-party librsvg library used for SVG processing. The inclusion of an external library (librsvg) in the processing pipeline illustrates how supply chain dependencies can introduce severe vulnerabilities into widely-used frameworks. Because Next.js powers a large number of production web applications, unpatched instances represent a significant attack surface for full system compromise. The out-of-band nature of this patch signals the urgency — organizations that rely on routine patch cycles risk prolonged exposure to actively exploitable flaws.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- cve — CVE-2026-96889