Next.js security update, October 2026: check and patch CVE-2026-96889

#!/usr/bin/env node
// next-security-check.mjs: checks a Next.js project against the October 14,
// 2026 advisories (CVE-2026-96889, GHSA-673q-mjm6-r5xr, GHSA-p3m5-59mp-jv5r).
// No dependencies. Run it in the project root, after installing packages:
//   node next-security-check.mjs [path]
// It reads the versions actually installed in node_modules (npm, pnpm or yarn),
// not package.json ranges. Exit code: 0 = patched, 1 = action needed.
import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";

// --- version helpers ---------------------------------------------------------
export function parse(version) {
  const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(version ?? "");
  return m ? { major: +m[1], minor: +m[2], patch: +m[3], pre: m[4] ?? "" } : null;
}

export function compare(a, b) {
  const x = parse(a);
  const y = parse(b);
  for (const k of ["major", "minor", "patch"]) if (x[k] !== y[k]) return x[k] - y[k];
  if (x.pre === y.pre) return 0;
  if (!x.pre) return 1; // a release is newer than its pre-releases
  if (!y.pre) return -1;
  return x.pre < y.pre ? -1 : 1;
}

const between = (v, lo, hi) => compare(v, lo) >= 0 && compare(v, hi) <= 0;

// --- the advisories ----------------------------------------------------------
// Returns one row per advisory: { id, title, affected, fixedBy, applies, note }
export function assess({ next, sharp = [], rsd = [], features }) {
  const rows = [];
  const nextFix = next && parse(next).major >= 16 ? "16.4.1" : "15.5.28";

  // CVE-2026-96889: RCE in Image Optimization with SVG, via sharp (glibc Linux).
  const imgRange = next && (between(next, "10.0.0", "15.5.27") || between(next, "16.0.0", "16.4.0"));
  const oldSharp = sharp.filter((v) => compare(v, "0.35.5") < 0);
  rows.push({
    id: "CVE-2026-96889",
    title: "Image Optimization RCE with SVG (critical)",
    // sharp is the real fix: 15.5.28 still accepts sharp ^0.34.3, and 0.34.x has
    // no fixed release, so an old sharp is a problem on any Next.js version.
    inRange: Boolean(imgRange) || oldSharp.length > 0,
    affected: Boolean(next && compare(next, "10.0.0") >= 0) && oldSharp.length > 0,
    fixedBy: imgRange ? `next ${nextFix}, or sharp 0.35.5+ for every copy` : "sharp 0.35.5+ for every copy (npm install sharp@^0.35.5)",
    applies: features.nextImage || features.svgAllowed ? "your app uses next/image" : "no next/image found, but the endpoint still exists",
    note:
      imgRange && oldSharp.length === 0
        ? `next ${next} is in range, but every sharp copy is 0.35.5+ (the documented workaround).`
        : oldSharp.length
          ? `sharp ${oldSharp.join(", ")} installed; needs 0.35.5+${imgRange ? "" : " (this Next.js still accepts it: run npm install sharp@^0.35.5)"}.`
          : "",
  });

  // GHSA-673q-mjm6-r5xr: RCE in `use cache` returning typed arrays (16.x only).
  const cacheRange = next && between(next, "16.0.0", "16.4.0");
  rows.push({
    id: "GHSA-673q-mjm6-r5xr",
    title: "use cache RCE (critical, Next.js 16)",
    inRange: Boolean(cacheRange),
    affected: Boolean(cacheRange),
    fixedBy: "next 16.4.1",
    applies: features.useCache ? "your code has \"use cache\"" : "no \"use cache\" found; Vercel still says upgrade",
    note: "",
  });

  // GHSA-p3m5-59mp-jv5r: Server Actions denial of service.
  const dosRange = next && (between(next, "13.0.0", "15.5.27") || between(next, "16.0.0", "16.4.0"));
  rows.push({
    id: "GHSA-p3m5-59mp-jv5r",
    title: "Server Actions denial of service (high)",
    inRange: Boolean(dosRange),
    affected: Boolean(dosRange) && features.serverActions,
    fixedBy: `next ${nextFix}`,
    applies: features.serverActions ? "your code has \"use server\"" : "no Server Actions found: not vulnerable",
    note: dosRange && !features.serverActions ? "In the affected range, but only apps with Server Actions are vulnerable." : "",
  });

  // React Server Components packages installed directly (GHSA-xqc2-xf4c-x3h3).
  const rsdFixed = { "19.0": "19.0.9", "19.1": "19.1.10", "19.2": "19.2.9", "19.3": "19.3.1" };
  const badRsd = rsd.filter(({ version }) => {
    const p = parse(version);
    const fix = p && rsdFixed[`${p.major}.${p.minor}`];
    return fix && compare(version, fix) < 0;
  });
  rows.push({
    id: "GHSA-xqc2-xf4c-x3h3",
    title: "React Server Components packages (critical)",
    inRange: badRsd.length > 0,
    affected: badRsd.length > 0,
    fixedBy: "react-server-dom-* 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1",
    applies: rsd.length ? "installed directly" : "not installed directly (Next.js bundles its own)",
    note: badRsd.map((r) => `${r.name}@${r.version}`).join(", "),
  });

  if (next && parse(next).major < 15 && imgRange) {
    rows[0].note += " Next.js 14 and older get no fixed release: upgrade to 15.5.28 or 16.4.1.";
  }
  return rows;
}

// --- reading the project ---------------------------------------------------------
function readJson(file) {
  try {
    return JSON.parse(readFileSync(file, "utf8"));
  } catch {
    return null;
  }
}

/** Every installed copy of the named packages, including nested and pnpm copies. */
export function findInstalled(root, names) {
  const wanted = (name) => names.some((n) => (n.endsWith("*") ? name.startsWith(n.slice(0, -1)) : name === n));
  const found = [];
  const visited = new Set();

  const walkModules = (dir) => {
    let real;
    try {
      real = realpathSync(dir);
    } catch {
      return;
    }
    if (visited.has(real)) return; // pnpm symlinks can loop
    visited.add(real);
    for (const entry of safeReaddir(dir)) {
      if (entry === ".pnpm") {
        for (const store of safeReaddir(path.join(dir, entry))) walkModules(path.join(dir, entry, store, "node_modules"));
      } else if (entry.startsWith("@")) {
        for (const sub of safeReaddir(path.join(dir, entry))) visitPackage(path.join(dir, entry, sub), `${entry}/${sub}`);
      } else if (!entry.startsWith(".")) {
        visitPackage(path.join(dir, entry), entry);
      }
    }
  };

  const visitPackage = (dir, name) => {
    if (wanted(name)) {
      const pkg = readJson(path.join(dir, "package.json"));
      if (pkg?.version) found.push({ name: pkg.name ?? name, version: pkg.version, path: dir });
    }
    const nested = path.join(dir, "node_modules");
    if (existsSync(nested)) walkModules(nested);
  };

  walkModules(path.join(root, "node_modules"));
  return found;
}

function safeReaddir(dir) {
  try {
    return readdirSync(dir);
  } catch {
    return [];
  }
}

const SOURCE_DIRS = ["app", "src", "pages", "components", "lib"];
const SOURCE_EXT = /\.(m?[jt]sx?)$/;

export function detectFeatures(root) {
  const features = { appRouter: false, useCache: false, serverActions: false, nextImage: false, svgAllowed: false };
  features.appRouter = existsSync(path.join(root, "app")) || existsSync(path.join(root, "src", "app"));
  const scan = (dir) => {
    if (!existsSync(dir)) return;
    for (const entry of readdirSync(dir, { withFileTypes: true })) {
      if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
      const full = path.join(dir, entry.name);
      if (entry.isDirectory()) scan(full);
      else if (SOURCE_EXT.test(entry.name)) {
        const text = readFileSync(full, "utf8");
        if (/["']use cache(?::[^"']*)?["']/.test(text)) features.useCache = true;
        if (/["']use server["']/.test(text)) features.serverActions = true;
        if (/from\s+["']next\/(legacy\/)?image["']/.test(text)) features.nextImage = true;
      }
    }
  };
  for (const d of SOURCE_DIRS) scan(path.join(root, d));
  for (const name of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
    const file = path.join(root, name);
    if (existsSync(file) && /dangerouslyAllowSVG\s*:\s*true/.test(readFileSync(file, "utf8"))) features.svgAllowed = true;
  }
  return features;
}

export function check(root) {
  const installed = findInstalled(root, ["next", "sharp", "react-server-dom-*"]);
  const nextPkg = readJson(path.join(root, "node_modules", "next", "package.json"));
  const next = nextPkg?.version ?? installed.find((p) => p.name === "next")?.version ?? null;
  const sharp = [...new Set(installed.filter((p) => p.name === "sharp").map((p) => p.version))];
  const rsd = installed.filter((p) => p.name.startsWith("react-server-dom-") && !p.path.includes(`${path.sep}next${path.sep}`));
  const features = detectFeatures(root);
  return { next, sharp, rsd, features, rows: assess({ next, sharp, rsd, features }) };
}

// --- CLI ---------------------------------------------------------------------
if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
  const root = path.resolve(process.argv[2] ?? ".");
  const r = check(root);
  if (!r.next) {
    console.log(`No installed next package found under ${root}. Run npm install first.`);
    process.exit(1);
  }
  const f = r.features;
  console.log("Next.js security check (October 14, 2026 advisories)");
  console.log(`next:     ${r.next}`);
  console.log(`sharp:    ${r.sharp.length ? r.sharp.join(", ") : "not installed"}`);
  console.log(`features: App Router ${f.appRouter ? "yes" : "no"}, "use cache" ${f.useCache ? "yes" : "no"}, Server Actions ${f.serverActions ? "yes" : "no"}, next/image ${f.nextImage ? "yes" : "no"}`);
  console.log("");
  let action = false;
  for (const row of r.rows) {
    action ||= row.affected;
    console.log(`${row.affected ? "FIX " : "ok  "} ${row.id.padEnd(20)} ${row.title}`);
    const detail = row.inRange || row.id === "GHSA-xqc2-xf4c-x3h3" ? `${row.applies}${row.note ? `. ${row.note}` : ""}` : `next ${r.next} is not affected`;
    console.log(`      ${detail}`);
    if (row.affected) console.log(`      Fix: ${row.fixedBy}`);
  }
  console.log("");
  console.log(action ? "Action needed: upgrade, reinstall, rebuild and redeploy." : "No action needed for these advisories.");
  process.exit(action ? 1 : 0);
}

# in the project root, after npm install / pnpm install / yarn
node next-security-check.mjs
echo "exit code: $?"   # 0 = nothing to do, 1 = action needed

Next.js security check (October 14, 2026 advisories)
next:     16.3.0
sharp:    0.35.3
features: App Router yes, "use cache" no, Server Actions yes, next/image yes

FIX  CVE-2026-96889       Image Optimization RCE with SVG (critical)
      your app uses next/image. sharp 0.35.3 installed; needs 0.35.5+.
      Fix: next 16.4.1, or sharp 0.35.5+ for every copy
FIX  GHSA-673q-mjm6-r5xr  use cache RCE (critical, Next.js 16)
      no "use cache" found; Vercel still says upgrade
      Fix: next 16.4.1
FIX  GHSA-p3m5-59mp-jv5r  Server Actions denial of service (high)
      your code has "use server"
      Fix: next 16.4.1
ok   GHSA-xqc2-xf4c-x3h3  React Server Components packages (critical)
      not installed directly (Next.js bundles its own)

Action needed: upgrade, reinstall, rebuild and redeploy.

ok 1 - version comparison
ok 2 - unpatched Next.js 16 app with every feature: all three Next.js advisories
ok 3 - patched Next.js 16.4.1 with sharp 0.35.5: nothing to do
ok 4 - the 15.x lockfile trap: next 15.5.28 but an old nested sharp
ok 5 - sharp workaround on an unpatched 15.x: image RCE cleared, DoS remains
ok 6 - Pages Router app without Server Actions is not hit by the DoS
ok 7 - pnpm layout: finds packages inside node_modules/.pnpm, survives symlinks
ok 8 - assess flags old React Server Components packages per minor line
# pass 8
# fail 0

$ npm install next@15.5.28
$ node next-security-check.mjs
next:     15.5.28
sharp:    0.34.5
FIX  CVE-2026-96889       Image Optimization RCE with SVG (critical)
      your app uses next/image. sharp 0.34.5 installed; needs 0.35.5+
      (this Next.js still accepts it: run npm install sharp@^0.35.5).

$ npm install sharp@^0.35.5
$ node next-security-check.mjs
...
No action needed for these advisories.

npm install next@16.4.1 react@19.2.9 react-dom@19.2.9 sharp@^0.35.5
npm install -D eslint-config-next@16.4.1
npm ls sharp
# codewares@0.1.0
# +-- next@16.4.1
# | `-- sharp@0.35.5 deduped
# `-- sharp@0.35.5