Next.js released an out-of-band security update on October 14 to address two critical flaws that permit unauthenticated remote code execution.
One code-execution flaw affects React Server Components, while the other is in librsvg, an open-source library used by Next.js via the sharp package for SVG image processing.
The update also fixes a high-severity denial-of-service flaw.
Sources and references
Original report
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00NA3QU6
Cite this
APA
Interestana AI Editorial. (2026, October 15). Next.js Patches Critical RCE Flaws in Caching and SVG. Interestana. https://interestana.com/articles/nextjs-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing-00na3qu6
MLA
“Next.js Patches Critical RCE Flaws in Caching and SVG.” Interestana, 15 Oct. 2026, interestana.com/articles/nextjs-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing-00na3qu6.
Chicago
Interestana AI Editorial. “Next.js Patches Critical RCE Flaws in Caching and SVG.” Interestana, October 15, 2026. https://interestana.com/articles/nextjs-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing-00na3qu6.
BibTeX
@misc{interestana_00na3qu6,
author = {{Interestana AI Editorial}},
title = {{Next.js Patches Critical RCE Flaws in Caching and SVG}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/nextjs-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing-00na3qu6},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html}
}Credit the source
Original reporting: The Hacker News, “Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing”, https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe