next-security-check

Check a Next.js project against the October 14, 2026 Next.js security advisories in one command, with no dependencies:

• CVE-2026-96889 (GHSA-2464-fhr4-w9xw): remote code execution in the Image Optimization API with SVG, via sharp (critical)
• GHSA-673q-mjm6-r5xr: remote code execution in use cache functions returning typed arrays (critical, Next.js 16)
• GHSA-p3m5-59mp-jv5r: denial of service in Server Actions (high)
• GHSA-xqc2-xf4c-x3h3: React Server Components packages, if installed directly (critical)

It reads the versions actually installed in node_modules (npm, pnpm or yarn layouts, including nested copies), not the ranges in package.json, and scans your source for "use cache", "use server" and next/image.

Full write-up: Next.js security update, October 2026

Usage

Requires Node.js 18 or later. Run it in the project root after installing packages:

curl -O https://raw.githubusercontent.com/AmanSin001/next-security-check/main/next-security-check.mjs
node next-security-check.mjs            # current folder
node next-security-check.mjs ./my-app   # or a path
echo $?                                 # 0 = nothing to do, 1 = action needed

Example output

A real install of Next.js 16.3.0 with Server Actions and next/image:

Next.js security check (October 14, 2026 advisories)
next:     16.3.0
sharp:    0.35.3
features: App Router yes, "use cache" no, Server Actions yes, next/image yes

FIX  CVE-2026-96889       Image Optimization RCE with SVG (critical)
      your app uses next/image. sharp 0.35.3 installed; needs 0.35.5+.
      Fix: next 16.4.1, or sharp 0.35.5+ for every copy
FIX  GHSA-673q-mjm6-r5xr  use cache RCE (critical, Next.js 16)
      no "use cache" found; Vercel still says upgrade
      Fix: next 16.4.1
FIX  GHSA-p3m5-59mp-jv5r  Server Actions denial of service (high)
      your code has "use server"
      Fix: next 16.4.1
ok   GHSA-xqc2-xf4c-x3h3  React Server Components packages (critical)
      not installed directly (Next.js bundles its own)

Action needed: upgrade, reinstall, rebuild and redeploy.

The sharp trap on Next.js 15

Next.js 15.5.28 still accepts sharp ^0.34.3, and the 0.34 line has no fixed release. If sharp is in your own package.json or locked in your lockfile, upgrading Next.js leaves it in place. The checker flags this and suggests npm install sharp@^0.35.5.

Fixed versions

Line	Fixed release
Next.js 16	16.4.1
Next.js 15	15.5.28
sharp	0.35.5 or later
react-server-dom-*	19.0.9, 19.1.10, 19.2.9, 19.3.1

Tests

node --test next-security-check.test.mjs

Eight cases, including pnpm's .pnpm layout, symlinks, the 15.x sharp trap and Pages Router apps.

Limitations

• The source scan looks at app, src, pages, components and lib. Code generated at build time or living in another package is not seen. When in doubt, upgrade.
• It reports on the installed packages only. Rebuild and redeploy after upgrading; a running server keeps the old code.

License

MIT. Need it patched for you? CodeWares.