React and Next.js advisories

React, React Server Components and Next.js advisories: framework RCEs, middleware bypasses and patched releases.

CriticalVulnerabilityPatch available

Next.js October 2026 security release: two critical RCEs, and check your sharp version

Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.

14 Oct 2026CVE-2026-96889React and Next.js npm

CriticalVulnerabilityPatch available

React2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough now

An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.

3 Dec 2025CVE-2025-55182, CVE-2025-66478, CVE-2025-55184, CVE-2025-67779, CVE-2025-55183, CVE-2026-23864npm React and Next.js