Next.js October patch: three holes, two of them remote code execution

Figure: Netlify security advisory for the Next.js and React vulnerabilities (source: netlify.com, captured 2026-10-19)

Three issues, two critical and one high, all patched in 15.5.28 and 16.4.1. If you self-host next start, this is your problem today.

The three holes

1. SVG image processing RCE — malicious image input reaches code execution through the image pipeline.
2. use cache RCE — cache components can be driven into executing attacker-controlled input.
3. Server Action DoS — crafted requests exhaust resources without authentication.

Why “out of band” matters

Out-of-band patches do not wait for the next minor release. If your upgrade policy is “next minor”, you are exposed until then.

Who is affected

Anyone running the affected versions, including self-hosted deployments and platforms that have not rebuilt. Managed platforms such as Netlify and Vercel patched their edge, but your own deployment still needs the new version.

What I would do, in order

1. Check your version.
2. Upgrade to 15.5.28 or 16.4.1.
3. Rebuild and redeploy.
4. Verify the deployment actually runs the new version.
5. Rotate any secrets that were reachable.

What this really reminds me

Framework security is supply-chain security. A framework CVE is an application CVE.

Trigger conditions

The image RCE needs attacker-controlled image input; the cache RCE needs cache components in use; the DoS needs a reachable Server Action. Not every app is exposed to all three, but the first two are common.

Verify after upgrading

Check next --version, check the build output, and test the affected features (image optimization, cache components, Server Actions).

A deployment checklist

• Version pinned in lockfile.
• CI builds from the lockfile.
• Deploy artifact reports the new version.
• Monitoring covers 5xx spikes after deploy.

No CVE number does not mean no problem

Some of these were published without a CVE. Treat an advisory from the framework team as sufficient.

Closing

Upgrade, redeploy, verify. Then check whether your upgrade policy would have caught this.