CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Impact

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.24-tuxcare.4.

TuxCare rebuilt next to address 4 CVEs. Fixed in 16.0.6-tuxcare.14.

TuxCare rebuilt next to address 1 CVE. Fixed in 13.5.11-tuxcare.21.

TuxCare rebuilt next to address 2 CVEs. Fixed in 15.1.2-tuxcare.5.

TuxCare rebuilt next to address 1 CVE. Fixed in 14.2.35-tuxcare.16.

TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.24-tuxcare.5.

TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.26-tuxcare.4.

TuxCare rebuilt next to address 2 CVEs. Fixed in 15.5.25-tuxcare.4.

TuxCare rebuilt next to address 2 CVEs. Fixed in 15.5.23-tuxcare.5.

Root has patched CVE-2026-94482 in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-2464-fhr4-w9xw in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-673q-mjm6-r5xr in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-vcvr-r3jv-pc5j in the next package for Root:npm. Multiple fixed versions available.