p PatchFirst

PatchFirst · Latest vulnerabilities

next 16.3.8: known vulnerabilities

Known vulnerabilities affecting next 16.3.8: 3. Compare the fixes below with your installed release.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. GHSA-673q-mjm6-r5xr

    Not ratedFix available

    Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

    ## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.

    nextNode.js
    • Update to 16.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-2464-fhr4-w9xw

    Not ratedFix available

    Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

    ## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

    nextNode.js
    • Update to 16.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-94482

    High · CVSS 8.2EPSS 0.36%Fix available

    Next.js: Denial of Service in App Router using Server Actions

    Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

    nextNode.js
    • Update to 16.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →