Next.js 16.4.1 & NGINX 1.31.7: October 2026 Web-Stack Patch Guide

The `use cache` RCE (GHSA-673q-mjm6-r5xr) affects Next.js 16.0.0 through 16.4.0 and requires an App Router application with Cache Components enabled where a `use cache` function returns more than one typed array. Vercel states there is no workaround and advises upgrading even if no vulnerable function is obvious in your code.

The SVG/sharp RCE (CVE-2026-96889, GHSA-2464-fhr4-w9xw) affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. It is fixed in 16.4.1, or in 15.5.28 when paired with sharp 0.35.5 or later. The high-severity DoS (GHSA-p3m5-59mp-jv5r) affects App Router apps with at least one Server Action and is fixed in 15.5.28 and 16.4.1.

nginx.org's security advisories list the following as fixed in 1.31.7 and 1.30.6, all rated Medium by the project. Some secondary write-ups cite F5 CVSS 8.1 scores for the three memory-safety bugs, so treat the vendor-assigned severity as the floor and prioritise internet-facing reverse proxies.

• •CVE-2026-97205 — use-after-free when using asynchronous file I/O (AIO); affects 0.8.11–1.31.6
• •CVE-2026-93479 — buffer overflow in script evaluation; affects 1.31.2–1.31.6 and 1.30.0–1.30.5
• •CVE-2026-15176 — buffer overflow when using alias with rewrite; affects 0.1.29–1.31.6
• •CVE-2026-95101 — request body injection in HTTP/3; affects 1.25.0–1.31.6
• •CVE-2026-97629 — session forgery when using TLS session tickets (ticket key left uninitialised on rotation); affects 1.23.2–1.31.6

Both products commonly sit in front of the same applications, so check them together: a Next.js app behind an NGINX reverse proxy inherits risk from each layer.

• •Next.js: run `npm ls next sharp` in every deployed project and container image; flag any next below 16.4.1 (or below 15.5.28 on the 15.x line)
• •Next.js: grep for the `use cache` directive and Cache Components configuration to prioritise 16.x apps where the RCE precondition is plausible
• •Next.js: identify apps that process user-supplied SVG through next/image or sharp, and apps exposing Server Actions
• •NGINX: run `nginx -v` on every host and container; anything up to 1.31.6 (or 1.30.5 on stable) is affected
• •NGINX: check configs for the exposed features — `aio`, `alias` combined with `rewrite`, `listen ... quic` / HTTP/3, and `ssl_session_tickets` — to see which of the five flaws are reachable
• •Distribution and appliance builds (distro packages, NGINX Plus, Ingress Controller) carry their own fixed versions; check the supplier advisory rather than the upstream version string

No exploitation has been reported, so this is expedited scheduled patching rather than an emergency change — but the Next.js flaws are unauthenticated RCE, so keep the window short.

• •Upgrade Next.js to 16.4.1 or 15.5.28 and rebuild and redeploy; on 15.x confirm sharp is 0.35.5 or later
• •Interim Next.js mitigation for the SVG flaw only: pin sharp to 0.35.5 or later, or block SVG decoding in sharp. This does not cover the `use cache` RCE, which has no workaround
• •Upgrade NGINX to 1.31.7 (mainline) or 1.30.6 (stable) and reload; verify with `nginx -v` after the restart
• •If NGINX cannot be upgraded immediately, disable unneeded exposure: HTTP/3 listeners, TLS session tickets, and AIO where not required
• •Rotate TLS session ticket keys after upgrading if ticket resumption was enabled on an affected version

Absent public exploit detail there are no reliable indicators of compromise yet. Focus on anomaly detection around the affected components.

• •NGINX: alert on repeated worker process crashes or unexpected `worker process exited on signal` lines in error.log, the likely symptom of the memory-safety bugs
• •Next.js: review requests that upload or reference SVG files against image-optimisation routes, and unexpected child processes spawned by the Node.js server
• •Watch the CISA KEV catalog and vendor advisories for any of the CVE IDs above; if one is added, the federal remediation deadline is typically three weeks out and exploitation should be assumed