AgentDAST / Security Brief

Next.js security update: two code-execution risks and a Server Actions fix

First reported Oct 14, 2026

CVE-2026-96889GHSA-673q-mjm6-r5xrGHSA-p3m5-59mp-jv5r

Next.js's October 14 release addresses two critical code-execution vulnerabilities and a denial-of-service issue. One critical flaw affects certain App Router Cache Component functions that return multiple typed arrays. The other, CVE-2026-96889, concerns image optimization on glibc-based Linux. The denial-of-service issue affects App Router applications with Server Actions.

Who should check

Exposure depends on the framework version, features and runtime. Read each advisory rather than assuming every Next.js application has the same attack surface. The Cache Components advisory lists Next.js 16.0.0 through 16.4.0 as affected.

What to do now

1. Upgrade the relevant supported branch to Next.js 16.4.1 or 15.5.28, or a later release containing these fixes, then rebuild and redeploy.
2. Check the deployed dependency tree. The image-optimization advisory identifies sharp 0.35.5 or later as its workaround; that does not fix the separate Cache Components issue.
3. Follow the framework's advice to upgrade even if you do not recognize the vulnerable cache pattern. Confirm your running deployment uses the updated lockfile.

What this means for your website

Patch status and live application behavior answer different questions. Keep dependency updates in the release process, then test authorization, data exposure and other reachable behavior on the deployed website.

Sources and updates

• Next.js: October 14 security update ↗
• Next.js advisory: image optimization / CVE-2026-96889 ↗
• Next.js advisory: Cache Components ↗

This brief reflects the sources checked on Nov 3, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Keep reading

• Tailscale SSH and Serve: update the systems behind your website
• Searchjacked: browser extensions can expose your team's searches