# Next.js is at or above the October 14 2026 patched release floors

- **Pattern:** `ab-002654` (`dependency-supply-chain.security-vulns.nextjs-patched-floor`)
- **Severity:** critical
- **Lifecycle:** active
- **Last modified:** 2026-10-30
- **Canonical URL:** https://auditbuffet.com/patterns/ab-002654
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-002654)

## Why it matters

The October 14 2026 Next.js security release fixed two Critical remote-code-execution advisories and one High denial-of-service advisory. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is unauthenticated RCE through Image Optimization with SVG input, and GHSA-673q-mjm6-r5xr is RCE through `use cache` functions that return typed arrays. GHSA-p3m5-59mp-jv5r is a denial of service in App Router Server Actions. The patched floors are 16.4.1 on the 16.x line and 15.5.28 on the 15.x line. An app resolving `next` below those floors is exposed to advisories with public write-ups, and generic dependency checks do not pin these floors. CWE-1104 and OWASP A06 apply.

## Severity rationale

Critical because two of the three advisories are unauthenticated or near-unauthenticated remote code execution against the running server, reachable by anyone who can send a request.

## Remediation

Upgrade `next` to at least 16.4.1 (16.x line) or 15.5.28 (15.x line), then regenerate the lockfile so the resolved version moves too, not just the range in `package.json`.

```bash
# 16.x line
npm install next@16.4.1 eslint-config-next@16.4.1
# 15.x line (stay on 15.5, no major upgrade needed)
npm install next@15.5.28 eslint-config-next@15.5.28
npm ls next
```

Pin `next` to an exact version if you want upgrades to be deliberate, and keep `eslint-config-next` on the same version. If you cannot upgrade immediately, upgrade `sharp` to 0.35.5 or later as an interim mitigation for the image-optimization advisory and disable SVG handling in the image optimizer. Neither is a substitute for the upgrade. Add a CI step that fails when `npm ls next` reports a version below the floor.

## Detection

**The detection method for this pattern is part of AuditBuffet Pro.**

The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the [Dependency & Supply Chain Audit](https://auditbuffet.com/audits/dependency-supply-chain). The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.

## External references

- cwe CWE-1104
- cwe CWE-94
- owasp A06
- ssdf PW.4.1

Taxons: supply-chain

HTML version: https://auditbuffet.com/patterns/ab-002654