Next.js Out-of-Band Update Fixes Two Critical RCEs

Two critical unauthenticated remote code execution flaws in Next.js. Vercel pushed an out-of-band patch on October 14, 2026.

The vulnerabilities affect separate components: the framework’s caching subsystem and its SVG processing pipeline. A third flaw, rated high severity, enables denial of service. No CVE IDs appeared in public advisories consulted for this report. Exploitation status: unconfirmed at time of writing.

The Hacker News has full coverage of the release and technical scope.

Why out-of-band matters

Next.js ships on a standard release cadence. Stepping outside that cadence signals Vercel assessed severity too high to wait. Both critical flaws sit on pre-authentication attack surface: no session, no credential required.

This is not the first time Vercel has used an emergency release for Next.js. The August 2026 AVIF and Windows RCE pair followed the same channel. That prior incident targeted the image processing pipeline and a Windows-specific server path; these October flaws are in different subsystems entirely.

Affected deployments

Vercel-managed deployments receive the patch automatically. Self-hosted operators do not. The patched build is available through npm. No workarounds have been published for either critical flaw.

Next.js runs across a broad range of production deployments as one of the most widely used React frameworks. The unauthenticated attack vector on both critical flaws means no prior foothold is required. Unpatched instances exposed to the internet are at highest risk.

Related coverage

• Next.js Patches Two Critical RCEs: Update Now — the August 2026 out-of-band pair covering AVIF handling and Windows-hosted builds
• CVSS 9.8 Code Injection in openapi-typescript-codegen — supply-chain risk in JavaScript tooling
• Docker Hub fixes critical image impersonation flaw — October cloud security roundup