Node.js and Next.js: Two Critical Vulnerabilities in One Week and How to Protect Your Website

In one week of October 2026, urgent fixes were released for Node.js and Next.js. Both had vulnerabilities that let an attacker run their own code on your server.

If your website, online store or bot runs on Node.js or Next.js, update them. It takes 15 to 30 minutes. Below are simple step-by-step instructions.

What Node.js and Next.js are

Imagine a car.

Node.js is the engine. It makes a program run on the server. Thousands of websites, bots, APIs and online stores run on it.

Next.js is the body and interior. It’s a ready-made foundation for a website: pages, images, forms. Next.js always runs on top of Node.js.

In October, problems were found in both the engine and the body. So both need to be fixed. If you update only Next.js, the engine keeps its defect. And vice versa.

Node.js: dangerous unpacking

On October 21, Node.js released fixes for 10 vulnerabilities at once. The most dangerous one was assigned CVE-2026-111497.

What the bug is. To make data travel faster over the network, it is compressed. One popular compression method is called Brotli. Node.js can decompress such data. A bug was found in the decompressor.

Imagine a vacuum bag with clothes. You cut it open and the clothes settle onto the shelf. Now imagine a specially crafted bag. When unpacked, the items spill beyond the shelf and fall onto the neighboring ones. It’s the same here: specially prepared data, when decompressed, gets written where it shouldn’t. This lets an attacker run their own code.

Who is at risk. All applications that decompress data from outside sources. For example, if your server receives responses from third-party APIs via fetch() or runs on Express 5.

Three more serious bugs. They relate to certificate and address checks. Imagine a guard checking passes. If a number on the pass is written in a special font, the guard lets the wrong person through. Likewise, in some cases Node.js could accept a fake for a genuine server.

There is no workaround. The only protection is updating.

Next.js: a picture with a surprise

On October 14, Next.js released an urgent update. It closes two critical vulnerabilities rated 9.5 out of 10 and one high-severity one.

First: dangerous SVG images (CVE-2026-96889). Next.js can resize and compress images for a website on its own. For this it uses the sharp library. A bug was found in it when processing SVG images.

It’s like a Trojan horse. On the outside it’s an ordinary picture. But inside is hidden code that runs when the server starts processing it. This is dangerous if your site lets users upload images. Affected Next.js versions are 10 through 15.5.27 and 16.0 through 16.4.0.

Second: a cache bug (GHSA-673q-mjm6-r5xr). It affects only new sites on Next.js 16 with the Cache Components feature enabled. An attacker can run their own code without a password. There is no temporary fix, only updating.

Third: denial of service. Through specially crafted requests to a site’s forms (Server Actions), the server can be “flooded” and the site stops opening.

Important. The usual npm audit check does not see all of these vulnerabilities. So don’t rely on it alone. Check the versions manually, as described below.

Who is affected

Node.js. Everyone who has anything running on Node.js on their server:

• sites on Next.js, Nuxt, Remix, Astro;
• APIs on Express, NestJS, Fastify;
• Telegram and Discord bots;
• admin panels, dashboards and online stores built with JavaScript;
• programs in Docker containers based on node: images.

Next.js. Everyone whose site is built on Next.js versions 10 through 16.4.0 and runs on their own server or VPS.

Node.js 20, 23, 25 and earlier versions will not receive fixes. Their support has ended. It’s like a phone that no longer gets security updates. You can keep using it, but it gets riskier every month.

Find out the versions

Connect to the server via SSH.

Node.js version:

node -v

Next.js and sharp versions. Go to the site folder and run:

npm ls next sharp

Compare with the table:

A server may have several Node.js installations. For example, if you installed it via nvm or it runs inside Docker. The node -v command shows only one. Also check the processes that are actually running:

ps aux | grep node

Update Node.js

The method depends on how Node.js was installed.

If via nvm (the most common option for developers):

nvm install 24
nvm alias default 24

Replace 24 with your branch: 22, 24 or 26. nvm will install the latest version of that branch itself.

If via the Ubuntu or Debian package manager:

sudo apt update
sudo apt install --only-upgrade nodejs

If in Docker. Change the version in the first line of the Dockerfile. For example:

FROM node:24.22.1-bookworm-slim

After updating, run node -v again and make sure the version matches the table.

If you have Node.js 20 or older. Moving to 22 or 24 is no longer a simple update but a migration. Like going from Windows 7 to Windows 11: most programs will work, but some things may break. First test the site on a staging server.

Update Next.js and sharp

Before updating, save a copy of the project or make a git commit. If something goes wrong, you can go back in a minute.

Next.js 16:

npm install next@latest eslint-config-next@latest

Next.js 15:

npm install next@15.5.28
npm install sharp@^0.35.5

The second command matters. On Next.js 15, the old sharp 0.34 often stays in place after the update. Then the image hole remains open.

Check the result:

npm ls next sharp

And rebuild the site:

npm run build

Bonus. If you haven’t updated for a long time, this update also closes the vulnerabilities fixed in September. Then Next.js released another fix for a dangerous image generation bug and seven fixes for caching and data protection.

Restart and rebuild

After the update, the new version is on disk. But the old one keeps running in memory until you restart it. It’s like buying new tires and carrying them in the trunk. The car is still riding on the old ones.

If the site runs via PM2:

pm2 restart all

If via systemd (replace mysite with your service name):

sudo systemctl restart mysite

If in Docker:

docker compose build --pull
docker compose up -d

The --pull flag makes Docker download a fresh base image. Without it, it may take an old one from the cache.

After restarting, open the site and check the main pages, forms and image uploads.

Checklist

• Found out the Node.js version with node -v
• Checked for other running Node.js instances
• Updated Node.js to 22.23.4, 24.22.1 or 26.12.1
• Saved a copy of the project before updating
• Updated Next.js to 16.4.1+ or 15.5.28+
• Checked that sharp is not lower than 0.35.5
• Rebuilt the site with npm run build
• Restarted the application or containers
• Checked that the site, forms and images work

Don’t want to figure it out yourself?

On paper everything looks simple. In practice, after updating Next.js the build may fail with a cryptic error. Or the server may turn out to have three different Node.js versions, and it’s unclear which one serves the site. Or moving from Node.js 20 may drag along an update of half your dependencies.

For such cases Zomro has two options.

SOD: we’ll update it for you

Our system administrator will:

• find all Node.js versions on the server and in containers;
• update Node.js, Next.js and sharp to safe versions;
• rebuild and restart the application;
• check that the site works after the update.

Price: €12.50 for every 15 minutes of work.

[Order the update]

Premium: fast help when you need it

If the site goes down after an update, every hour of downtime costs money. A regular technical request can take up to 10 hours to answer. With Premium we respond within 5 to 30 minutes.

Node.js and Next.js release security fixes almost every month. With Premium you won’t have to deal with them alone.