Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerabilities in Next.js

20 October 2026

Attackers can exploit critical vulnerabilities in Next.js to perform remote code execution. Patch immediately.

Background

Vercel has released security updates addressing critical vulnerabilities (GHSA-673q-mjm6-r5xr and CVE-2026-96889) affecting Next.js.

These vulnerabilities both have Common Vulnerability Scoring System (CVSS v4.0) scores of 9.5 out of 10.

Impact

Successful exploitation of these vulnerabilities could result in the following:

  • GHSA-673q-mjm6-r5xr (No CVE ID issued as of publication): A vulnerability affecting Next.js applications using App Router with Cache Components that could allow an unauthenticated, remote attacker to perform remote code execution when using a “use cache” function that returns multiple typed arrays.

  • CVE-2026-96889: A vulnerability that could allow an unauthenticated, remote attacker to perform remote code execution on applications, when Next.js runs on glibc-based Linux due to a memory-related vulnerability discovered in an upstream library used for Image Optimisation.

Affected Products

These vulnerabilities affect the following Next.js versions:    

  • 16.x: Versions prior to 16.4.1

  • 10.x to 15.x: Versions prior to 15.5.28

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References

https://nextjs.org/blog/nextjs-security-update-october-14-2026 (opens in new tab)

https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr (opens in new tab)

https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw (opens in new tab)

https://nvd.nist.gov/vuln/detail/cve-2026-96889 (opens in new tab)