Next.js 16.4.1 Patches Two Unauthenticated RCE Bugs in the Framework AI Apps Are Built On

Vercel released Next.js 16.4.1 on October 14, and the changelog is almost entirely security fixes. Two are rated critical, both unauthenticated remote code execution: one in use cache functions that return typed arrays (GHSA-673q-mjm6-r5xr), and one in the Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw). A third, rated high, is a denial of service in the App Router via Server Actions (GHSA-p3m5-59mp-jv5r). The release was tagged by GitHub user eps1lon, sits 179 commits ahead of the canary branch, and carries a verified signature.

That is the news. Here is why it matters more than a routine patch Tuesday.

The framework is now AI infrastructure whether Vercel admits it or not

Next.js is the default React framework for a huge share of the web, and over the past two years it has quietly become the substrate for a specific kind of application: the AI product. Chat interfaces, agent dashboards, RAG front-ends, “vibe-coded” internal tools, the demo apps that VCs fund and the prototypes that become products. When Anthropic, OpenAI, or any of the dozens of agent startups ship a web surface, a large fraction of the time it is Next.js underneath, deployed to Vercel.

That makes these three advisories a supply-chain story, not a framework story. The blast radius of an unauthenticated RCE in Next.js is not “some marketing sites.” It is every AI product whose backend logic runs in the same process as the framework’s server runtime.

What the bugs actually are

The first critical, in use cache functions returning typed arrays, is the interesting one. use cache is Next.js’s newer caching primitive, the mechanism that lets a server component or function declare its output cacheable. Typed arrays (Uint8Array, Float32Array, and friends) are exactly what AI code passes around constantly: embeddings, token buffers, image tensors, serialized model outputs. A cache layer that mishandles typed arrays on the way in or out is a cache layer that can be tricked into executing something it should have treated as data. Vercel has not published the mechanism, and we are not going to guess at it. But the shape of the bug, unauthenticated RCE triggered through a cache path that handles binary buffers, is the shape of a bug that lives in AI-adjacent code.

The second critical is the Image Optimization API and SVG. SVG is XML, XML can carry script, and an image optimizer that renders or transforms SVG server-side is a classic confused-deputy setup. Again: unauthenticated, remote, code execution. If your Next.js app exposes the built-in image optimizer, which is the default, and you accept user-supplied SVGs, you were exposed until you upgraded.

The high-severity DoS in Server Actions is the least dramatic and the most operationally annoying. Server Actions are the RPC layer that Next.js apps use to call backend functions from the client without writing an API route. A DoS there means an unauthenticated attacker can pin your server. For an AI app where the “server action” is a call into a model provider, that is a bill-attack vector as much as an availability one.

The uncomfortable take

Vercel has spent two years positioning Next.js as the AI-native framework. The company’s own marketing leans hard on the idea that this is the stack you build agents on. That positioning is not wrong. It is exactly why these advisories should worry people more than the severity ratings alone suggest.

A framework that wants to be the runtime for AI applications inherits the threat model of AI applications. That threat model is worse than the threat model of a blog. AI apps take untrusted input by definition (user prompts, uploaded files, tool outputs), they handle binary data as a first-class concern (embeddings, tensors, images), and they frequently run code paths that were never designed to face the public internet. The use cache bug is a cache bug, but it is a cache bug in the exact subsystem AI builders lean on hardest.

There is a second-order problem too. A large and growing share of Next.js code is now written by AI coding assistants. Those assistants are trained on the framework’s idioms, and they will happily generate an app that exposes the image optimizer, accepts SVG uploads, and wires a Server Action to an expensive backend call without a rate limit. The model does not read the advisory. The developer does not read the advisory either, half the time, because the assistant said the code was fine.

What to do, and what to watch

Upgrade to 16.4.1. If you cannot upgrade immediately, disable the Image Optimization API for untrusted SVG input, audit any use cache function that returns a typed array, and put a rate limit in front of your Server Actions. These are not exotic mitigations.

The thing to watch is whether Vercel publishes technical write-ups for GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw. Right now the release notes give us severity, surface, and a link. That is enough to patch and not enough to learn from. The use cache advisory in particular deserves a postmortem, because if the caching primitive that AI apps depend on can be walked into code execution, the next framework to copy the pattern will inherit the same hole. Vercel has not said whether a write-up is coming. We asked and will update if we hear back.

{/* TODO: comment sought from Vercel on whether technical write-ups for GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw are planned */}

The version number is the story’s least interesting detail. The interesting detail is that the framework the AI industry standardized on shipped two unauthenticated RCE fixes in a single point release, and the changelog is four lines long.