Next.js RCE Patches, Docker 29.9.1, Node Oct 21 Alert

Executive Summary

• Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCEs and one high-severity DoS. Read the official security update and patch now.
• Next.js 16.4.2 is the current stable patch, with Turbopack fixes backported; the 16.5.0 canary line reached canary.17 on Oct 17. See the v16.4.2 release.
• Docker Engine 29.9.1 (Oct 14) updates containerd to 2.4.2, fixing three vulnerabilities. See the Docker Engine release notes.
• Node.js shipped 26.12.0 (Current) and 24.22.0 (LTS) on Oct 14, and announced security releases for Wednesday, Oct 21. Watch the Node.js blog.

Next.js: Two Critical RCEs and a Server Actions DoS

The out-of-band release, published Oct 14, carries fixes postponed from September because of upstream dependency delays. Three issues are covered:

• GHSA-673q-mjm6-r5xr (Critical): unauthenticated RCE in App Router apps with Cache Components when a use cache function returns multiple typed arrays. There is no known workaround, so upgrade even if you have no similar functions.
• CVE-2026-96889 / GHSA-2464-fhr4-w9xw (Critical): RCE in the Image Optimization API with SVG, caused by a memory issue in an upstream library, on glibc-based Linux. Workaround: make sure the sharp version used by Next.js is 0.35.5 or later.
• GHSA-p3m5-59mp-jv5r (High): crafted requests against App Router apps with at least one Server Action cause excessive CPU use and block further requests in the same process. Pages Router apps and apps without Server Actions are not affected.

Upgrade to the patched line you run:

npm install [email protected]  # Maintenance LTS
npm install [email protected]   # Active LTS

# confirm the resolved sharp version (needs >= 0.35.5)
npm ls sharp

Next.js 16.4.2 and the 16.5 Canaries

v16.4.2 (Oct 15) is marked Latest and backports fixes to the LTS line: turbo-tasks snapshot consistency, Pages Router dev module graph chaining, Turbopack lazy dynamic-import chunk-list collisions, a Turbopack GC fix for half-torn-down dependency edges, and ignoring realpath errors during module resolution. See the v16.4.2 tag. On the canary track, v16.5.0-canary.15 brings Partial Prefetching and Cached Navs fixes, canary.16 passes Server Action request metadata into App rendering, and canary.17 prefetches multi-page SST blocks in turbo-persistence.

Docker Engine 29.9.1: containerd 2.4.2 Security Fixes

Per the release notes, the bundled containerd moves to v2.4.2, covering: CVE-2026-95839 (a malformed digest in a child descriptor can crash containerd when pulling or importing an image); GHSA-8647-2jxj-p2rc (a crafted Content-Length header from an untrusted registry can crash containerd with parallel layer fetching enabled); and GHSA-hc94-p972-ch66 (a crafted image can exhaust host disk because layer data was not capped at the declared size).

Other fixes: --link-local-ip no longer accepts non-link-local addresses (which stopped containers starting), docker ps -s no longer fails when one container's size can't be computed, a daemon panic with the fluentd log driver (async mode, unreachable TLS address) is fixed, and RootlessKit is updated to v3.3.0.

docker version --format '{{.Server.Version}}'   # expect 29.9.1
docker info --format '{{.ContainerdCommit.ID}}'

Node.js: New Releases and a Security Release on Oct 21

Node.js 26.12.0 (Current) and 24.22.0 (LTS) were released Oct 14 per the Node.js blog. The project also pre-announced security releases for Wednesday, October 21. Details such as CVEs and affected lines are not yet in the excerpt I could read, so reserve a patch window for your Node 22, 24 and 26 services this week.

Action Checklist

1. Upgrade Next.js to 16.4.1+ or 15.5.28 and verify sharp is 0.35.5 or newer.
2. Roll Docker Engine 29.9.1 across build and registry-pulling hosts.
3. Schedule Node.js upgrades for Oct 21 and rebuild base images afterwards.

Coverage note: today's audit confirmed the items above against official sources. No verified new releases were found for the remaining tracked stacks, so they are omitted rather than guessed.