[nextjs]

October 17, 2026

• Next.js shipped an out-of-band update on 14 October (16.4.1 and 15.5.28) fixing two unauthenticated RCE flaws rated 9.5: one in React Server Components, triggered in version 16 apps where a use cache function returns more than one typed array, and CVE-2026-96889 in librsvg via the bundled sharp, reachable on glibc Linux when attacker-supplied SVGs are passed to the optimiser. A Server Actions DoS is also fixed; the use cache and Server Actions issues have no workaround (The Hacker News). A Chinese-language analysis of the chain is already circulating (Doonsec). · Vulnerabilities & Patches

in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD