2026 年 10 月 Next.js、Node.js 與 PHP 漏洞修補版本及升級方法

Originally published at its-tahir.com.

If you run Next.js 16.0.0 to 16.4.0, upgrade to 16.4.1. On 15.x, upgrade to 15.5.28. Those releases, published on 14 October 2026, fix two critical unauthenticated remote code execution bugs (one in use cache, CVE-2026-96889 in Image Optimization) and a denial of service in Server Actions. Next.js 14 and older get no patch: make sure sharp is 0.35.5 or later and move to 15.5.28.

Is your version affected?

This site runs next@16.4.2 with sharp@0.35.5, so it was covered. The machine I build it on wasn't: its Node.js was a minor version behind the fix released a week later.

The same fortnight brought fixes for the runtime under Next.js and for PHP:

None of these has a workaround that fully replaces upgrading, with one exception: for the Next.js Image Optimization bug, a fixed sharp closes it.

Last checked: 25 October 2026. I'll update this post when PHP fixes CVE-2026-115560.

Check your versions in 10 seconds

I ran these on my own machine and on this site's repository before writing this. One needed action: Node.js on the machine I build on.

Next.js and sharp. From the project root:

npm ls next sharp

It prints your next version and every copy of sharp in the tree, including ones pulled in by other packages. Every sharp should be 0.35.5 or higher. With pnpm or Yarn, pnpm why sharp or yarn why sharp show the same. This site printed next@16.4.2 and sharp@0.35.5, so both Next.js fixes are in.

Don't check sharp with require('sharp/package.json'). Current sharp doesn't export that path, and Node throws instead of printing a version:

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './package.json' is not defined by "exports" in ...\node_modules\sharp\package.json

Node.js. This one-liner compares your runtime with the patched version for its line:

node -e "const [M,m,p]=process.versions.node.split('.').map(Number);const fix={22:[23,4],24:[22,1],26:[12,1]}[M];console.log(process.version, !fix?'end-of-life line: no fix, move to 22, 24 or 26':(m>fix[0]||(m===fix[0]&&p>=fix[1]))?'patched':'VULNERABLE: upgrade')"

On my Windows machine it printed:

v22.22.3 VULNERABLE: upgrade

Check CI runners and Docker base images too, not only servers: the runtime on your laptop is rarely the one serving traffic.

PHP. On the server, or inside the container that serves requests:

php -v

You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on your branch. The CLI and the web server's PHP can differ: with PHP-FPM or mod_php, check the version the web server loads (a phpinfo() page you delete afterwards, or your host's panel). I don't run PHP in production, so I didn't test this one on a live server.

If PHP came from your distribution (apt, dnf, apk), the version number may never reach these releases: Debian, Ubuntu and RHEL backport security fixes into their own package versions. Check your distribution's security tracker for CVE-2026-109618 and CVE-2026-109619 instead of comparing version numbers.

If you build on the official Docker images, patched tags exist. On Docker Hub, php:8.5.12-apache, 8.4.27-apache, 8.3.36-apache and 8.2.35-apache (Debian bookworm variants) were up by 21 October, and node:22.23.4 by 22 October. Pull and rebuild: an image built last week keeps its old runtime until you rebuild it.

Find your release line and upgrade to at least the version on the right. End-of-life lines get no fix at all.

The Next.js advisories: two critical RCEs and a DoS

Next.js published an out-of-band update on 14 October 2026, announced a week ahead, with two fixes that had been held back from the September release for upstream dependencies. The GitHub advisory database listed them on 22 October, which is when most dependency scanners started flagging them.

npm install next@16.4.1   # 16.x
npm install next@15.5.28  # 15.x

Unauthenticated RCE in use cache functions (GHSA-673q-mjm6-r5xr, critical)

GHSA-673q-mjm6-r5xr affects 16.0.0 to 16.4.0: apps on the App Router with Cache Components, where a use cache function returns multiple typed arrays. The root cause is in React Server Components, tracked as GHSA-xqc2-xf4c-x3h3 and fixed in react-server-dom-webpack, -turbopack and -parcel 19.0.9, 19.1.10, 19.2.9 and 19.3.1. If you use React Server Components outside Next.js, upgrade those packages directly.

The Next.js team's advice is blunt: there is no workaround, and you should upgrade "even if your application does not have similar functions". Don't spend time grepping for typed arrays.

Unauthenticated RCE in Image Optimization with SVG (CVE-2026-96889, critical)

CVE-2026-96889 / GHSA-2464-fhr4-w9xw affects 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0. The bug is memory corruption in an upstream library the Image Optimization API uses. The advisory scopes the RCE to Next.js running on glibc-based Linux, such as Debian and Ubuntu based images. Patch anyway if you're elsewhere: the advisory doesn't say other platforms are safe.

The advisory's title says "when SVG files are used", but the text doesn't name a config option or image source that controls it, so don't treat "we don't serve SVGs" as a safe answer.

This is the one with a real workaround: make sure the sharp Next.js uses is 0.35.5 or later. Fresh installs already get it. That matters most on Next.js 14 and older, which have no patched release: the advisory's only fixed versions are 15.5.28 and 16.4.1.

Denial of service in Server Actions (GHSA-p3m5-59mp-jv5r, high)

GHSA-p3m5-59mp-jv5r affects 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Crafted requests to an App Router app with at least one Server Action burn CPU and block every other request in that process. Pages Router apps, and apps without Server Actions, aren't affected. There's no workaround besides upgrading, so on Next.js 13 or 14 this stays open until you move to 15.5.28.

There's also a medium-severity cache leak, fixed in 16.3.8, where nested use cache functions could serve content cached for one root param value to requests for another. 16.4.1 includes it.

If upgrading Next.js 16 breaks your build with a Turbopack and webpack config error, that's a separate, known problem with a quick fix.

The runtime under Next.js: Node.js CVE-2026-111497 ("Node2Shell")

Upgrading next doesn't patch the Node.js it runs on. Node.js shipped security releases on 21 October 2026 for every supported line: 22.23.4, 24.22.1 and 26.12.1. There are ten CVEs, and the most serious is rated high.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder Node bundles. A malicious compressed stream makes the decoder write past an eight-byte internal buffer. The Node.js advisory says the result can be a crash, memory disclosure or remote code execution. Security firms named it Node2Shell.

On 22 October a public proof of concept appeared, though it only reached code execution against a deliberately weakened build. Researchers cited by Aikido have since reported code execution against the official, unmodified Node.js 24.22.0 image on Linux arm64, though not on every attempt. No exploitation in the wild had been reported as of 22 October.

You're exposed when Node decompresses Brotli data that someone else controls:

• Incoming requests. Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, and any client can send one. A bare node:http server doesn't decode request bodies on its own.
• Outgoing fetch(). It decompresses Brotli responses automatically, so a malicious or compromised server you call can reach the bug through its response. Next.js server code that fetches from third-party APIs counts.
• node:zlib. Any Brotli function you call on untrusted input.

Node offers no workaround. Rejecting Content-Encoding: br at your proxy or middleware cuts the inbound path. Vercel added WAF rules on 21 October that block it inbound for every project. Neither covers responses your app fetches, which is why the runtime upgrade is the only full fix. Vercel's bulletin also notes that Next.js does not block Brotli responses in image optimization.

Node 20 gets nothing. Node.js 20, 23 and 25 are end of life and won't receive this fix. If you deploy to Vercel on Node 20.x, change the project to 22.x or 24.x and redeploy. Vercel manages patch versions for 22.x and 24.x itself.

The other nine, briefly:

The same releases update the bundled CA certificates for the eMudhra intermediate CA compromise. eMudhra runs the emSign roots, and if you've been chasing emSign certificate errors in Node-based tools this month, that's related background: I covered one such case in Claude Code's UNABLE_TO_GET_ISSUER_CERT errors.

Also patched last week in the Next.js and Node ecosystem

Dependency scanners will flag these too. They're less severe, but several crash a Node process with one request:

The Sentry issue only bites when your middleware is the only place that checks authorisation for those routes, which is a good reason not to rely on middleware alone. The MCP SDK fixes matter if you run your own MCP server over HTTP. If you're new to MCP, here's what an MCP server is.

Same week: PHP2Shell, CVE-2026-109618 and CVE-2026-109619

If you also run PHP, this is the most urgent item in the post. PHP pre-announced a critical release on 20 October and shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. Both bugs are rated CVSS 9.2 and can allow unauthenticated remote code execution. In PHP's words: "There are no complete mitigations, updating is the only safe choice."

• CVE-2026-109618: out-of-memory handling interrupts PHP while internal request data is only partly initialised. The PHP Foundation says that on Apache with mod_php, an unauthenticated request can trigger it before any application code runs, and full RCE was shown with default settings. RCE was also confirmed on PHP-FPM through application code paths.
• CVE-2026-109619: request-owned state survives after its memory is freed. The reporter showed RCE against a real application on Apache with mod_php.

CISA's alert names the nickname PHP2Shell and says every PHP installation that serves web requests is affected: Apache mod_php (highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That includes PHP bundled inside other software, so check appliances and control panels too, not only your own servers.

The rollout was messy. According to the PHP Foundation, a leaked video and circulating proof-of-concept code drove a spike in activity on 21 October, though its security team found no functional exploit at release, and one image vendor published patched builds before the embargo ended. CISA had not seen successful exploitation when it published its alert. Don't wait for that to change.

PHP 8.1 and older get no fix. The PHP project no longer ships updates for them, and CISA's advice for systems you can't patch, which explicitly includes 8.1 and earlier, is to take them offline until they're upgraded. The official php:8.1 Docker images were last rebuilt on 2 January 2026. If you're on PHP 7.4, the same applies.

A third PHP issue with no patch yet: CVE-2026-115560

On 23 October PHP published an informational advisory for CVE-2026-115560, which isn't fixed yet. It only applies when session.serialize_handler is set to php_binary or php_serialize in configuration and then switched to php at runtime with ini_set() before session_start(). PHP's interim advice is to set this until the next regular release:

session.upload_progress.enabled = 0

Most apps don't use session upload progress, so for most of you this costs nothing.

Laravel shipped a critical fix the same week

CVE-2026-114509 is an authentication bypass in Laravel's built-in TokenGuard: with a standard token-based API guard on MySQL or MariaDB, a crafted non-string credential can authenticate as an existing user without their token. Fixed in laravel/framework 12.68.0 and 13.29.0. The advisory's affected range covers every version below 12.68.0, so Laravel 11 and older have no patched release.

Check with composer show laravel/framework. Upgrading PHP doesn't fix this one, and upgrading Laravel doesn't fix PHP2Shell. You need both.

Patch order

1. Internet-facing PHP, if you have any. It's unauthenticated, rated 9.2, proof-of-concept code circulated on release day, and on mod_php it fires before your code runs.
2. Next.js 16 on Cache Components, then any self-hosted Next.js on glibc Linux using Image Optimization.
3. Node.js runtimes that accept compressed request bodies (Express 5, body-parser 2) or fetch from servers you don't control. Include CI runners and base images.
4. End-of-life lines (Next.js 14 and older, Node 20/23/25, PHP 8.1 and older): no patch is coming, so schedule the upgrade now instead of waiting for one.
5. The dependency fixes in the table above, with one npm update and a lockfile check.

Behind a corporate proxy, npm install and docker pull may fail with certificate errors before you get to any of this. What each tool trusts behind a corporate proxy gets them working without turning off verification.

Key takeaways

• Next.js: upgrade to 16.4.1 or 15.5.28. 15.5.7 is still vulnerable. Next.js 14 and older have no patched release, so make sure sharp is 0.35.5 or later and move to 15.5.28.
• Upgrading next doesn't patch Node.js: 22.23.4, 24.22.1 or 26.12.1 fix the Brotli RCE (CVE-2026-111497). Node 20, 23 and 25 get no fix.
• PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 fix PHP2Shell (CVE-2026-109618, CVE-2026-109619). PHP 8.1 and older get no fix.
• Check the runtime that serves traffic, not only your laptop: rebuild Docker images and update CI runners.
• Set session.upload_progress.enabled to 0 until PHP fixes CVE-2026-115560, and patch Laravel separately for CVE-2026-114509.

FAQ

Security releases now land in clusters, and the expensive part is rarely the upgrade itself. It's finding every place the old runtime still runs: the base image nobody rebuilt, the CI runner, the PHP inside a control panel. I help teams set up AI and web stacks that stay patchable. See recent projects.

FAQ

Which Next.js versions are vulnerable to the October 2026 RCEs?

The use cache RCE (GHSA-673q-mjm6-r5xr) affects Next.js 16.0.0 to 16.4.0. The Image Optimization RCE with SVG (CVE-2026-96889) affects 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, and the Server Actions denial of service affects 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Upgrade to 16.4.1 or 15.5.28. Next.js 14 and older have no patched release.

Is Next.js 15.5.7 still vulnerable?

Yes. 15.5.7 is inside the affected range for the Image Optimization RCE (CVE-2026-96889) and the Server Actions denial of service, both fixed in 15.5.28. The use cache RCE only affects Next.js 16. Upgrade to 15.5.28 or later.

How do I check if my Next.js version is vulnerable?

Run npm ls next sharp in the project root. You are patched if next is 16.4.1 or later on 16.x, or 15.5.28 or later on 15.x, and every sharp listed is 0.35.5 or later. Next.js 14 and older have no patched release.

Does Next.js 14 get a security patch for these vulnerabilities?

No. The only fixed releases are 15.5.28 and 16.4.1. On Next.js 13 or 14 you can close the Image Optimization RCE by making sure sharp is 0.35.5 or later, but the Server Actions denial of service stays open until you upgrade to 15.5.28.

Do I need to update Node.js too?

Yes, if your Next.js app runs on Node.js 22, 24 or 26 below 22.23.4, 24.22.1 or 26.12.1. Those fix CVE-2026-111497, a Brotli decoder bug that can allow remote code execution. Node.js 20, 23 and 25 are end of life and get no fix. On Vercel, a project set to Node.js 20.x has to be switched to 22.x or 24.x and redeployed.

What is CVE-2026-111497 (Node2Shell) and am I exposed?

It is an out-of-bounds write in the Brotli decoder bundled with Node.js that can crash the process, leak memory or allow remote code execution. You are exposed if Node decompresses Brotli data an attacker controls: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding br, fetch() decompresses Brotli responses automatically, and any node:zlib Brotli call on untrusted input counts. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

PHP2Shell is the nickname for two critical PHP vulnerabilities, rated CVSS 9.2, that can allow unauthenticated remote code execution. One is memory corruption when out-of-memory handling interrupts PHP mid-request, the other is request state that survives after its memory is freed. CISA says every PHP installation that serves web requests is affected, with Apache mod_php at highest risk. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Is the PHP vulnerability patched?

Yes. The two critical ones are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. A third issue, CVE-2026-115560, has no patch yet. Until the next release, PHP suggests setting session.upload_progress.enabled to 0. It only applies when a non-default session serializer is switched back to php at runtime, but the setting is cheap to change.

Is PHP 7.4 or 8.1 vulnerable to PHP2Shell?

Treat them as vulnerable. The PHP project ships no fixes for PHP 8.1 or older, and CISA advises taking systems on PHP 8.1 or earlier offline until they are upgraded if you cannot patch. The official php:8.1 Docker images were last rebuilt on 2 January 2026, so they do not contain a fix.

Sources

• Next.js Security Update for Upstream Vulnerabilities (October 14, 2026)
• GHSA-673q-mjm6-r5xr: Unauthenticated RCE in use cache functions returning typed arrays
• GHSA-2464-fhr4-w9xw (CVE-2026-96889): Unauthenticated RCE in Image Optimization API when SVG files are used
• GHSA-p3m5-59mp-jv5r: Denial of Service in App Router using Server Actions
• GHSA-xqc2-xf4c-x3h3: Unauthenticated RCE in React Server Components
• Node.js: Wednesday, October 21, 2026 Security Releases
• Vercel: Node.js security advisory, Brotli decoder RCE
• Aikido: Node2Shell, Node.js Brotli vulnerability (CVE-2026-111497)
• PHP 8.5.12 release announcement
• The PHP Foundation: Today's PHP Security Release
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• GHSA-f9x3-7vq9-cph6: Laravel TokenGuard authentication bypass (CVE-2026-114509)
• GHSA-mchm-gjx6-7h55: Sentry Next.js SDK middleware bypass with tunnelRoute (CVE-2026-114139)
• GHSA-27r3-jxmh-p828: body-parser DoS via trailing bytes after a compressed body (CVE-2026-111181)
• GHSA-q7qp-rjg7-q26m: multer DoS with an asynchronous fileFilter (CVE-2026-113872)
• GHSA-xjj6-f33q-929c: undici fetch() crash on excessive content-encodings (CVE-2026-109869)
• GHSA-46jr-4wx8-v453: MCP TypeScript SDK memory exhaustion (CVE-2026-111768)

Originally published at its-tahir.com.