Next.js 16.4.1 fixes two critical remote-code-execution holes, and no older 16 release gets the fix

On October 8 the Next.js team gave six days' notice of an out-of-band update for two critical and one high-severity problem in upstream dependencies. On October 14 the unscheduled update shipped in 16.4.1 and 15.5.28. Jon's site is built on Next.js, and for the 16 line the fix exists in one version only.

It fixes three things. The first critical one is remote code execution through use cache functions that return several typed arrays, in App Router apps with Cache Components. It has no workaround and affects 16.0.0 through 16.4.0. The second critical one is remote code execution in the Image Optimization API when SVG files are used, on glibc-based Linux. It affects versions 10 through 15.5.27 and 16 through 16.4.0. The high-severity one is denial of service through Server Actions in App Router apps, and it has no workaround either.

These follow a critical next/og image hole fixed on September 22 in 16.3.6, and the September 30 release, which fixed one high-severity, five medium and one low-severity problem in 16.3.8. On October 15, 16.4.2 followed with bug fixes and no security changes, according to its release notes.

What matters is where the fixes land. Each security release since July landed on the newest 16 minor and on 15.5, and nowhere else. An app on 16.2 or 16.3 cannot take the security fix alone. It has to move to 16.4, feature changes included. Counting the two from August 25, the 16 line has had five critical advisories in seven weeks.

What to do about it

1. Find the installed version: npm ls next. Any 16 release up to 16.4.0 is in range of the October advisories.
2. Upgrade: npm install next@16.4.1, or 16.4.2 for the bug fixes too. On 15.5, npm install next@15.5.28.
3. Or hand it to an agent. Next.js 16.4 added npx next@canary upgrade --agent=latest, which checks the installed version, picks the target and prepares the migration guides, codemods and verification steps. It runs from an older version too.
4. If the upgrade cannot happen today, the image hole has a stopgap: make sure sharp is 0.35.5 or later (npm ls sharp). The other two have none.
5. Once on 16.4, experimental.agentUpgrade gives a reminder during next dev and next build, to a person or an agent, when a release fixes a known hole in the installed version. Its default policy is 'security'.

It costs nothing. The catch is step 2: from 16.2 or 16.3, the security fix arrives with a minor release's worth of other changes, so run the full checks before it ships.

What nobody knows yet

• Whether either critical hole has been used against real sites. The advisories do not say.
• Whether an app hosted on Vercel is exposed to the image hole. The advisory names glibc-based Linux and says nothing about hosts.
• Technical detail. The advisories give conditions and no proof of concept.

What to watch

• The next scheduled Next.js security release. They have come monthly since July, announced about a week ahead on the security page.