On 14 October, the Next.js and React teams shipped an out-of-band security update fixing three vulnerabilities, two of them critical with a CVSS score of 9.5. Next.js is one of the most widely used frameworks for building modern business websites and web apps, so this patch lands well beyond the usual developer-forum audience. The first flaw is an unauthenticated remote code execution bug in the framework's built-in Image Optimization feature, triggered by a memory-handling issue when it processes SVG images on Linux servers — it affects versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The second is an unauthenticated RCE in "use cache" (Cache Components), affecting any app on 16.0.0 through 16.4.0 that uses this caching feature in a specific way. A third, lower-severity denial-of-service flaw affects Server Actions. Fixes shipped in Next.js 16.4.1 and 15.5.28; there is no workaround short of upgrading.
Neither flaw has a confirmed public exploit yet, which is exactly why the framework's maintainers pushed the fix out-of-band rather than waiting for a scheduled release. Unauthenticated, remotely triggerable RCE bugs in a framework this widely deployed tend to get reverse-engineered into working exploits within days of disclosure, once security researchers and attackers alike start comparing the patched code to the vulnerable version. Security outlets including The Hacker News, Netlify and GBHackers have all flagged it as a "patch now" situation rather than a "patch when convenient" one.
What this means for your business
If your website, storefront, or web app was built with Next.js — common for everything from marketing sites to SaaS dashboards — this is worth a same-week conversation with whoever built or manages it. Ask them to confirm the site is running Next.js 16.4.1 or later (or 15.5.28 on the older supported branch), and that the underlying image-processing library sharp is on version 0.35.5 or newer; a normal dependency upgrade and redeploy covers both. Pay particular attention if your site lets visitors or admins upload images, including logos or profile pictures, since the SVG-processing flaw sits exactly on that path and needs no login to trigger. We rebuilt techleetsolutions.com on Next.js ourselves, so we applied this patch within hours of the advisory going out — it is a routine update, not a rebuild, but only if it actually gets applied before a public exploit starts circulating.