Multiple Critical Vulnerabilities in Next.js
Out-of-band security update addresses three vulnerabilities that, if exploited, could result in remote code execution or denial-of-service
Summary
Out-of-band security update addresses three vulnerabilities that, if exploited, could result in remote code execution or denial-of-service
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Vercel has released an out-of-band security update to address three vulnerabilities in Next.js, including two critical remote code execution (RCE) vulnerabilities and a high severity denial-of-service (DoS) vulnerability.
- GHSA-673q-mjm6-r5xr - Remote Code Execution - CVSSv4 score: 9.5
- CVE-2026-96889/GHSA-2464-fhr4-w9xw - Use After Free vulnerability - CVSSv3 score: 7.8
- GHSA-p3m5-59mp-jv5r - Denial of Service - CVSSv4 score: 8.2
Proof-of-Concept (PoC) Exploit for CVE-2026-96889
A PoC exploit has been reported for CVE-2026-96889. The vulnerability is a use-after-free issue in librsvg when processing specially crafted SVG content containing nested XIncludes with duplicate entity declarations, which could result in DoS or RCE. Where the version of sharp used by Next.js is 0.35.5 or later, this can be used as a workaround. The NHS England National CSOC assess that future exploitation of this vulnerability is likely.
Remediation advice
Affected organisations are encouraged to review Vercel's advisory Next.js Security Update and apply the relevant updates as soon as possible.
Definitive source of threat updates
Last edited: 19 October 2026 3:05 pm