Security Update: Next.js and React vulnerabilities (October 2026)

The Next.js and React teams have disclosed three security vulnerabilities (two critical, one high), released on October 14, 2026: a remote code execution (RCE) in SVG image processing, an RCE in use cache (Cache Components), and a denial of service (DoS) in App Router Server Actions. Here’s what Netlify customers need to know. Summary If you run Next.js on Netlify, we strongly recommend upgrading next to 15.5.28 or 16.4.1 and redeploying.