Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

As cited

Copy frozen at 2026-10-15 16:57 UTC (site build).

vulnerabilities

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band patch on October 14 addressing two critical remote code execution vulnerabilities, one in React Server Components and another in the librsvg library used for SVG processing. A high-severity denial-of-service flaw was also remediated in the update.

Why it matters: Developers using Next.js with React Server Components or SVG image handling face active exploitation risk and must apply this patch immediately to prevent unauthenticated code execution on their applications.

Source published

2026-10-15 12:28 UTC

First seen by Cybersecurity Tracker

2026-10-15 16:02 UTC