Next.js 16.4.1 Fixes 2 Critical RCEs, SvelteKit 3.1 Out

Executive Summary

• Security: Next.js 16.4.1 fixes two Critical remote code execution bugs and one High DoS in the App Router.
• Backport: Next.js 15.5.28 covers the SVG image RCE and the Server Actions DoS, but not the typed-array use cache advisory. Next.js 15 reaches end of life on October 21.
• Heads-up: Node.js pre-announced a security release for October 21 affecting 26.x, 24.x and 22.x, with HIGH as the top severity.
• Features: React 19.3.1 improves the RSC transport protocol; SvelteKit 3.1.0 adds CSP report-hash keywords and endpoint tracing spans.
• Fixes: NestJS 12.1.3 ships broad microservice transport and SSE fixes.

Next.js 16.4.1 and 15.5.28: Security Release

As announced on October 8, the out-of-band update landed on October 14 with three advisories:

• Critical: unauthenticated RCE in the Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw).
• Critical: unauthenticated RCE in use cache functions that return typed arrays (GHSA-673q-mjm6-r5xr).
• High: denial of service in the App Router via Server Actions (GHSA-p3m5-59mp-jv5r).

The advisory index did not list CVE IDs or version ranges at the time of writing; check each advisory page for the exact affected range. Upgrade now, and if you are still on 15.x, move to 15.5.28 and plan the jump to 16 before end of life.

If you cannot patch immediately, reduce exposure: restrict the Image Optimization endpoint to trusted sources and avoid returning typed arrays from use cache functions.

# Next.js 16 line
npm install [email protected]

# Next.js 15 line (no fix for the use cache typed-array advisory)
npm install [email protected]

The same day also produced 16.5.0 canaries (canary.11 and canary.12), which upgrade the repo's pnpm to v12 and tighten Turbopack's file watcher. They are pre-releases; do not run them in production.

Node.js: October 21 Security Release Pre-Announced

The pre-announcement states that 26.x, 24.x and 22.x are affected, with HIGH the highest severity fixed. CVE IDs and patched versions are not yet published. Reserve a patch window for October 21 and watch the Node.js vulnerability index. End-of-life lines are also affected and will not receive fixes.

React 19.3.1 and SvelteKit 3.1.0

React 19.3.1 contains a single change, an improved React Server Components transport protocol (PR #37845). The release notes list no security fixes, but because it shipped alongside the Next.js patch, keep React and Next.js versions aligned.

SvelteKit 3.1.0 adds the CSP report-sha256, report-sha384 and report-sha512 keywords and emits a sveltekit.endpoint span for +server handlers when server tracing is on. Fixes include server-only module detection inside a server directory, prerendered MIME type inference and focus handling in unfocused iframes.

const config = {
  kit: {
    csp: {
      directives: {
        'script-src': ['self', 'report-sha256']
      }
    }
  }
};
export default config;

The snippet is illustrative of where the new keyword goes; confirm exact syntax in the SvelteKit CSP docs before deploying.

NestJS 12.1.3

Bug-fix release (October 12). Request-scoped global enhancers now fail at startup instead of being silently dropped; SSE handling is hardened (headers, early disconnects, empty streams); Redis no longer crashes when its connection drops; Kafka tombstone null payloads are preserved; and Fastify shutdown hooks honor return503OnClosing. Teams on RabbitMQ, NATS, MQTT or gRPC transports also receive fixes.

Other Registry Movements (Last 7 Days)

These come from npm registry metadata only; I did not review their changelogs, so treat them as version bumps to evaluate rather than analyzed changes.

• Better Auth 1.7.9 (Oct 15)
• BullMQ 6.3.15 (Oct 14)
• Fastify 5.12.7 (Oct 13)
• Nuxt 4.6.1 (Oct 9)
• Astro 7.3.8 (Oct 8)
• Prisma 8.0.0-rc.22 (Oct 8, still a release candidate)

Coverage Notes

GitHub API access was unavailable during this audit, so Docker, Kubernetes, Keycloak, databases and several other tracked projects were not checked today. Nothing is implied about them either way.