> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
- URL: https://f4n6.co.uk/security-feed/next-js-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing/
- Published: 2026-10-15T22:56:12.000Z
- Updated: 2026-10-15T22:56:12.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Vercel released an out-of-band security update for Next.js on 2026-10-14 fixing two critical unauthenticated remote code execution flaws and one high-severity denial-of-service flaw. One RCE is in React Server Components; the other is in librsvg, reached through the sharp image-processing package that Next.js uses to handle SVG. No CVSS score, CVE identifier, or CISA KEV entry is available for the October flaws in the material supplied, so severity here rests on the vendor's own critical rating and the unauthenticated RCE outcome, not on a scored reference. EMEA financial services firms running Next.js in customer-facing or internal applications should treat any instance that renders attacker-influenced SVG through `next/og` ImageResponse or through sharp as internet-reachable code execution until patched. The related September ImageResponse flaw (fixed 2026-09-22) and the August AVIF/Windows path traversal flaws show this component has been a repeat target through 2026, which raises the priority of getting current.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                      | Practical impact                                                                                                                                                         |
| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| DORA Art. 28: ICT third-party risk, general principles | The flaws are in a third-party open-source framework (Next.js) and its transitive dependency (librsvg via sharp) that firms consume as a software supply chain input | Firms must be able to evidence that third-party software risk from this dependency chain is identified and managed, and that a vendor patch can be tracked to deployment |
| NIS2 Art. 21(2)(d): supply chain security measures     | Same dependency chain: a vulnerability in an upstream library (librsvg) surfaces through a downstream package (sharp) inside a framework (Next.js)                   | Supply chain security measures must cover transitive dependencies, not just direct vendors, and must include a route to act on an upstream library advisory              |

No DORA incident-reporting article is engaged on the facts supplied: the material describes a patched vulnerability, not an incident at a client. If a client confirms exploitation, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live and the classification and reporting clocks start.

## 3\. Technical analysis & attack chain

The October update fixes two critical RCE flaws and one high-severity DoS flaw. The source names the affected components but does not give CVE identifiers, CVSS scores, or affected version ranges for the October flaws. What follows is what the material supports.

Confirmed attack chain for the librsvg RCE (CVE-2026-96889), the flaw with the most technical detail available:

1. An application uses sharp to process an SVG image, either directly or through Next.js image handling.
2. The SVG is decoded by librsvg, the upstream library sharp depends on for SVG support.
3. A memory-related flaw in librsvg is triggered under certain runtime-specific conditions.
4. On glibc-based Linux, this can lead to remote code execution.
5. The RCE outcome depends on the node executable being compiled as a Position Independent Executable (PIE). Most Linux package managers ship PIE node binaries; the official Node.js binaries do not, so those deployments are exposed to the full RCE path.

The second critical RCE is in React Server Components. The source names the component and the critical rating but gives no mechanism, no CVE, and no version range. Treat the exploitation path as uncharacterised from this material.

The high-severity DoS flaw is named only by severity. No component, mechanism, or CVE is given.

Related flaws from the same component family, for context on exposure:

- CVE-2026-75604: a path traversal flaw in Next.js affecting servers that use a Windows filesystem, allowing unauthenticated RCE. Fixed in the August patch cycle.
- The August cycle also fixed a critical AVIF image handling RCE, exploitable via specially crafted AVIF files.
- The September ImageResponse flaw: the Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability that can lead to RCE. It applies when an application passes attacker-controlled values into SVG content, attributes, or styles during image generation. Vercel fixed it on 2026-09-22\. Applications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

The September advisory gives a concrete vulnerable pattern. A route handler reads a value from the request URL and interpolates it into SVG markup passed to `ImageResponse`:

```tsx
import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

```

Any application that follows this pattern is passing attacker-controlled input into the SVG rendering path. The same input-flow shape is what the October librsvg flaw requires: attacker-influenced SVG reaching the decoder.

Confidence caveats. The October item is single-sourced to The Hacker News and is truncated mid-sentence ("The fixes are in"), so the patched version numbers are not available from this material. The librsvg detail is corroborated by the GitHub advisory for sharp (GHSA-wq5f-xc86-pv6w). No exploitation in the wild, no threat actor, and no malware capability is described in any source. There is no attribution to make and none is implied.

## 4\. Mitigation & containment

P1 (within 24 hours)

- Inventory every Next.js deployment and every service that calls `next/og` ImageResponse or sharp. Prioritise internet-facing applications that render user-supplied or URL-derived values into SVG.
- Apply the 2026-10-14 out-of-band Next.js update to all affected instances. The source does not give the patched version numbers; obtain them from the Vercel release notes for the 2026-10-14 update before scheduling the change.
- For the librsvg RCE (CVE-2026-96889), upgrade sharp to 0.35.5, which bundles librsvg 2.63.2\. If librsvg is installed globally rather than via sharp's prebuilt binaries, upgrade librsvg to 2.63.2 directly.
- Confirm the node executable is compiled as a Position Independent Executable. Official Node.js binaries are not PIE and leave the librsvg RCE path open even after the library is patched. Replace official binaries with a distribution or package-manager build on any host that decodes SVG.

P2 (within 72 hours)

- Where the upgrade cannot be applied immediately, disable SVG decoding in sharp by adding the following to application code: `js sharp.block({ operation: ["VipsForeignLoadSvg"] });`
- Where the September ImageResponse flaw is still unpatched, stop passing attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`. This is the vendor's stated workaround and it also removes the input flow the October librsvg flaw needs.
- Audit route handlers for the pattern in §3: a request-derived value interpolated into SVG markup. Rewrite to a fixed allowlist or drop the dynamic value.

P3 (within 7 days)

- Add the Next.js, sharp, and librsvg versions to your software bill of materials and to dependency scanning so the next upstream librsvg advisory is caught at the library, not at the framework.
- Confirm the August fixes are in place: CVE-2026-75604 (Windows path traversal RCE) and the AVIF RCE. Any host still on a pre-August Next.js is exposed to three separate unauthenticated RCE paths.
- Review whether any Next.js service runs on a Windows filesystem; that combination is the precondition for CVE-2026-75604.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources describe vulnerable code patterns and affected components, not atomic artefacts. No hashes, domains, IPs, file paths, or registry keys are given.

Behavioural indicators:

| behaviour                                                                          | where to observe                                          | confidence                                     |
| ---------------------------------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------------- |
| Request-derived value interpolated into SVG markup passed to next/og ImageResponse | Application source and route handler code review          | high, from vendor advisory GHSA-vcvr-r3jv-pc5j |
| SVG decoding by librsvg in a Node.js process                                       | Process and library load telemetry on hosts running sharp | high, from GHSA-wq5f-xc86-pv6w                 |
| Node.js process executing from a non-PIE binary on glibc Linux                     | Host binary inspection                                    | high, from GHSA-wq5f-xc86-pv6w                 |

## 6\. Detection

The sources give no malicious strings, filenames, command lines, or network artefacts. The only concrete, matchable artefacts are the vulnerable code pattern and the sharp configuration call. A YARA rule built on CVE identifiers or product names would detect reporting about the flaw, not the flaw, so none is emitted.

A Sigma rule for the sharp SVG block call is not useful as a detection: it is a defensive control, not attacker behaviour. The one behaviour worth alerting on is a Node.js process loading librsvg and decoding SVG on a host that should not be doing so.

```yaml
title: Node.js Process Decoding SVG via librsvg
id: 8f3c1a72-4b6e-4d21-9c0a-2e7d5f1b9a44
status: experimental
description: Detects a Node.js process loading librsvg, the decode path for CVE-2026-96889 in sharp. Tune to hosts that legitimately process SVG.
author: Adverse Trace
date: 2026/10/15
references:

  - https://github.com/advisories/GHSA-wq5f-xc86-pv6w
logsource:
  category: image_load
  product: linux
detection:
  selection_process:
    Image|endswith: '/node'
  selection_library:
    ImageLoaded|contains: 'librsvg'
  condition: selection_process and selection_library
falsepositives:

  - Applications that legitimately render SVG through sharp
level: medium

```

## 7\. Sources

- The Hacker News, "Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing", https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html, 2026-10-15
- GitHub Security Advisories, "sharp: Vulnerability in librsvg dependency CVE-2026-96889", https://github.com/advisories/GHSA-wq5f-xc86-pv6w
- GitHub Security Advisories, "Next.js: Remote Code Execution in next/og ImageResponse", https://github.com/advisories/GHSA-vcvr-r3jv-pc5j
- The Hacker News, "Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input", https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html
- The Hacker News, "Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE", https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
- BSI Germany, "Vercel Next.js: Schwachstelle ermöglicht Codeausführung", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3538

## 8\. Adverse Trace position

Adverse Trace assesses the October Next.js flaws as high priority for any EMEA financial services client running Next.js in an internet-facing role, on the strength of the unauthenticated RCE outcome and the vendor's critical rating. We are not assigning a CVSS score: none is available for the October flaws in the material we hold, and we will not manufacture one. The librsvg flaw (CVE-2026-96889) is the better characterised of the two and the one with a clear, testable precondition (SVG decode plus a non-PIE node binary), so we would sequence that first. The React Server Components RCE is named but not described, which is itself a reason to patch rather than triage. We will obtain the patched version numbers from the Vercel release notes, since the source we hold is truncated, and we will re-issue this advisory if exploitation in the wild is reported or if a CVE and CVSS are assigned. Clients who confirm exploitation of any of these flaws should treat it as a reportable incident and start their DORA Art. 17 to 19 and NIS2 Art. 23 clocks.

---

[Read the original source →](https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*