Dark Web Intelligence (@DailyDarkWeb) on X

What it is

Vercel's out-of-band Next.js security release of Oct 14, 2026, relayed by a threat-intel account on X. The post says it is the official vendor advisory, not a dark-web claim. Per the post, the two critical fixes had been held back from the September release because of upstream dependency delays.

Preconditions / Affected

• Cache Components RCE (GHSA-673q-mjm6-r5xr, upstream React GHSA-xqc2-xf4c-x3h3): App Router app with Cache Components, where a "use cache" function returns multiple typed arrays. Unauthenticated.
• Image Optimization RCE (CVE-2026-96889 / GHSA-2464-fhr4-w9xw): SVG handling on glibc-based Linux. The cause is a memory bug in an upstream library used through sharp. Unauthenticated.
• DoS (GHSA-p3m5-59mp-jv5r): App Router apps using Server Actions. Rated high severity.

flowchart TD
    A[Next.js app] --> B{Cache Components + use cache returning typed arrays?}
    B -- yes or unsure --> C[Upgrade: no workaround]
    A --> D{Image Optimization on glibc Linux?}
    D -- yes --> E[Upgrade, or sharp 0.35.5+]

What to do

• Upgrade to the fixed releases on both supported LTS lines (Active and Maintenance). The page's version strings are mangled by email-obfuscation, so take the exact numbers from the primary advisory on nextjs.org.
• Vercel says to upgrade for the Cache Components flaw even if you have no such function. Don't triage that one by grepping for "use cache".
• If you can't upgrade immediately, sharp 0.35.5 or later is the stated workaround for the image RCE only.
• Patch internet-facing apps first.

Caveats

• No in-the-wild exploitation is reported yet.
• The post is a secondary summary. It gives no exploit detail, and the exact fixed versions must be confirmed against the primary advisory.