Next.js Issues Out-of-Band Patch for Two Critical RCE Flaws and DoS Vulnerability

Next.js released an out-of-band security update on October 14, 2026, that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service vulnerability. According to the advisory, one code-execution flaw is located in React Server Components, while the other is in librsvg, the open-source library that Next.js uses through the sharp package to handle SVG images. The third issue is a high-severity denial-of-service flaw. The updates were coordinated as an out-of-band release, indicating the severity and urgency of the issues. At the time of disclosure, there were no confirmed reports of public exploitation, though security researchers and potential attackers are expected to analyze the patches quickly. Next.js users are strongly advised to update to the latest available version immediately to mitigate the risks. The specific version numbers were not included in the initial source summary and should be verified via the official Next.js security advisory.