Next.js RCE fixes: patch to 16.4.1 or 15.5.28
Plus OpenCode 2.0, Python GA on Vercel, GitHub Actions lockfiles and Postgres 19 RC 1
The main thing
On October 14, Next.js shipped an out-of-band security update with fixes for two critical unauthenticated remote code execution bugs. Upgrade now:
npm install next@16.4.1 # 16.4 (Active LTS)
npm install next@15.5.28 # 15.5 (Maintenance LTS)
These are the two fixes that missed the September security release because of upstream dependency delays. Who is exposed:
- RCE in
use cache(fixed in 16.4.1): App Router apps with Cache Components, when ause cachefunction returns multiple typed arrays. There is no workaround. The post says to upgrade even if your app has no function like that. - RCE in the Image Optimization API (fixed in 16.4.1 and 15.5.28): a memory bug in an upstream library, triggered by SVG files, when Next.js runs on glibc-based Linux. If you can't upgrade today, make sure the version of sharp that Next.js uses is 0.35.5 or later. Upgrading Next.js pulls in a fixed sharp automatically.
- Denial of service (High, both lines): crafted requests to App Router apps with at least one Server Action can eat enough CPU to block other requests in that process. Pages Router apps and apps without Server Actions are not affected.
The post gives the fixed versions but not the first affected versions. Until the advisories say otherwise, treat any 16.x before 16.4.1 and any 15.5 before 15.5.28 as exposed. No exploitation has been reported.
Self-hosting on Linux? Check which sharp version your lockfile actually resolves, because the SVG bug depends on that library.
React also shipped 19.3.1, 19.2.9, 19.1.10 and 19.0.9 the same day. Each has a single note for Server Components: "Improve transport protocol." The release notes don't mention a security issue, so don't assume they are part of this fix. Still, you're already updating dependencies, so pick them up.
Quick bits
OpenCode 2.0 is out. One background server now powers the TUI, web and desktop apps, and agents can hand work to background subagents. 1.0 plugins and the old server API stop working. From the latest 1.x, run opencode upgrade --major. (discussion)
Python on Vercel is generally available. It auto-detects FastAPI, Flask, Django and FastHTML and adds Python SDKs for storage, queues and workflows. Vercel Daemons, for long-running queue workers, is in public beta. Your Celery workers finally get a nice apartment.
Meta released Muse Spark Open, an open-weight mixture-of-experts model for agentic coding. It has 816B total parameters with about 42B active per token, a 1M-token context and image, audio and video input. The NVFP4 build needs a full B200 node. Your laptop can sit this one out.
Node.js 24.22.0 LTS adds crypto.parsePKCS12(), a generic MAC API, util.throttle and util.debounce. 26.12.0 Current now throws when WebAssembly or RX support is missing. These are not the October 21 security releases. Somewhere, a lodash import checks its pulse.
Anthropic's Scion is heavily inspired by Mononoke. A former Mononoke engineer says Scion's "derived data" design follows Meta's Mononoke, and that crediting only Sapling "borders on plagiarism." Commenters point out that Mononoke is part of Sapling. (discussion)
GitHub Actions workflow lockfiles are in public preview. The gh actions-lock extension writes .github/workflows/actions.lock, which pins actions and their transitive dependencies to commits, so a moved tag can't swap in new code. Dependabot keeps the entries updated.
TV4 pushed back The Challenge after a report said an AI agent erased an edited season. TV4 denies that and blames a failed backup system at the production company. The premiere moves from November 22 to late spring. (discussion)
PostgreSQL 19 RC 1 is out. RC 2 comes November 12, and general availability is planned for November 19. Coming from an earlier version, you'll need pg_upgrade or pg_dump/pg_restore, so test now.
Patch roundup
- CVE-2026-21589, Atlassian Data Center products (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, plus Crucible and Fisheye): get the fixed versions from Atlassian's advisory.
Patch Next.js before your second coffee. Test a restore before your third.