Next.js released an out-of-band security update fixing two remote code execution flaws and a denial-of-service issue in versions 16.4.1 and 15.5.28.
Learn what components are affected and how to apply the patches.
The problems of remote execution
The first issue concerns the way temporary data is handled. Only applications based on version 16 that have a specific storage feature enabled are affected if a function returns more than one piece of data of a specific type.
The second issue is related to the way SVG images are processed, via a third-party library used in the background. This issue occurs when the applications are running on certain Linux systems. The fix is to upgrade the built-in library to a newer version.
The temporary outage problem
The third issue concerns system overload. In applications that have at least one active server action, a specially crafted request could fully occupy the resources, preventing other users from being served. Applications that do not use these actions do not face this risk.
READ ALSO
NGINX patches five security vulnerabilities, one from 2005
Who is affected and what needs to be done?
The fixes are included in the new Next.js versions 16.4.1 and 15.5.28.
As of October 15, 2026, there have been no reports of actual attacks exploiting these security issues. However, upgrading is recommended immediately to protect applications.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)