Next.js Delivers Delayed Fixes
Next.js’s awaited fixes are available. Its 14 October follow-up supplies three patches, including two delayed from September by upstream dependencies.
16.4.1 lists all three October fixes; 15.5.28 lists the SVG and Server Actions fixes. Treat these as the October baselines, then verify the package actually serving requests.
Three fixes, different exposure
| Issue | Relevant scope | Fixed baseline |
|---|---|---|
Unauthenticated use cache RCE, critical |
App Router with Cache Components; a function returns multiple typed arrays. Range: 16.0.0 through 16.4.0. No workaround. The vendor urges upgrading even without a similar function. | 16.4.1 |
| CVE-2026-96889, critical unauthenticated SVG RCE | Image Optimisation on glibc-based Linux. Ranges: 10.0.0 through 15.5.27, and strictly above 16.0.0 through 16.4.0. The dependency workaround is sharp 0.35.5 or later. |
15.5.28; 16.4.1 |
| Server Actions DoS, high | App Router with a Server Action. Crafted traffic can monopolise CPU, blocking that process. Pages Router and no-Action apps are excluded. Ranges: 13.0.0 through 15.5.27; 16.0.0 through 16.4.0. Upgrade is the only workaround. | 15.5.28; 16.4.1 |
The SVG advisory’s strict lower bound on its 16.x row is reproduced, not turned into an assurance about an unlisted build. Older affected branches need a supported patched deployment. A fresh dependency installation is not proof of what is already running.
Check the earlier boundaries, too
The 23 September advance notice was revised from nine fixes to seven, deferring a critical issue alongside a high-rated one. Its 29 September revision also said 16.3.7 contained a bug fix, not the security batch.
The 30 September release shipped through 16.3.8 and 15.5.27. The lists differ, so neither a shared product name nor a successful upgrade proves that every row applied to both branches.
| Issue and advisory | Reachability and consequence | 16.3.8 list | 15.5.27 list |
|---|---|---|---|
| CVE-2026-94483 High; advisory |
An attacker-influenced host in images.remotePatterns lets the optimiser reach private addresses. No remote patterns: not affected. |
Listed | Not listed |
| CVE-2026-94485 Medium; advisory |
Webpack App Router metadata images bypass dynamicParams for segments excluded by generateStaticParams(). Turbopack is outside scope. |
Listed | Listed; range conflict below |
| CVE-2026-94543 Medium; advisory |
Self-hosted Pages Router with SSG/ISR: cached content crosses routes until revalidation. Vercel-hosted applications are excluded. | Listed | Listed |
| CVE-2026-94484 Medium; advisory |
A root catch-all plus SSG/ISR lets an unauthenticated request contaminate shared responses. | Listed | Listed |
| CVE-2026-94544 Medium; advisory |
Cache Components or experimental.useCache, with draft-dependent functions: overlapping Draft Mode and ordinary requests can persist unpublished output in a prerender until revalidation. |
Listed | Not listed |
| CVE-2026-103004 Medium; advisory |
Nested use cache omits a root parameter from the outer key after a warm inner hit. Output crosses values; attackers cannot choose the leaked value. No workaround is known. |
Listed | Not listed |
| CVE-2026-94486 Low; advisory |
A hostile site reaches next dev’s unchecked-origin MCP endpoint, exposing paths, logs, route listings plus error snippets. Not production. |
Listed | Not listed |
Several advisory fix fields still show 16.3.? or 15.5.?. The metadata-image advisory describes 16.x, although the older branch’s release lists it. That conflict remains unresolved; BlackTree is not inventing a clean affected range. Release lists establish the packages shipped, not a universal exposure statement.
The Draft Mode and nested-cache advisories name 16.3.0 as affected. The nested-cache record now assigns the identifier linked above and an exact 16.3.8 fix. Its previously missing identifier is no longer a reason to omit the record.
A patch receipt needs a deployment check
BlackTree operational analysis: keep the feature comparison with the maintenance record. It separates a package change from a tested service outcome. These checks are recommendations, not evidence that a particular deployment was compromised.
- Confirm the artefact. Rebuild from a clean dependency installation and redeploy. Inspect the framework and native image dependency in the running container, serverless bundle or server, not only
package.jsonor a lockfile. - Test a known route. Identify an owner and a representative request for each relevant feature above. Record the expected result before the change, then compare what the service returns afterwards.
- Preserve before purging. Map which application, proxy and CDN entries could contain affected output. Retain useful request and response evidence, then invalidate relevant entries after patching and confirm revalidation. Do not erase every cache as the first investigative step.
- Include development. Update developers’ environments too. Review what browser content and network paths can reach local tooling. A production-only inventory misses a different trust boundary.
- Check the whole deployment set. Repeat verification for old public previews, branch deployments and other serving copies. Closing the main production ticket does not retire them.
Hosting can change the path
Netlify’s 30 September guidance pairs the framework update with OpenNext adapter 5.16.1. The default auto-installed adapter updates on redeployment; pinned installations need a manual update. The adapter also avoids a cache-key serving regression, which Netlify distinguishes from the security fix.
Netlify says its Image CDN bypasses the SSRF path, isolated invocations prevent the Draft Mode overlap, and production builds do not serve the development endpoint. The metadata-image and other cache paths still need their own checks.
This is platform-specific guidance, not proof that October’s packages reached a particular deployment. Verify or retire old public previews and branch deployments through their owner-led change process. A current main deployment does not prove those copies were rebuilt.
Evidence and dates
The cited project announcements and advisories do not report exploitation in the wild. That limited observation does not prove attacks are absent. These issues are separate from BlackTree’s August report on two other unauthenticated RCE paths; the versions and conditions differ.
Source review: 19 October 2026. October’s announcement, releases and three advisories are dated 14 October. September’s release pages and seven advisories are dated 30 September; the nested-cache record changed on 1 October. This article retains its original 1 October publication date and URL.
