Next.js has published an out-of-band security update addressing two critical vulnerabilities that could allow unauthenticated remote code execution, as well as a high-severity denial-of-service issue. For businesses using Next.js in production, especially for public websites, customer portals and e-commerce applications, this is a high-priority patching event.

What happened

According to the reported update, the patched release fixes two separate critical remote code execution flaws. One affects React Server Components. The other involves SVG image processing through librsvg, which Next.js uses via the sharp package. The update also addresses a high-severity denial-of-service vulnerability.

Remote code execution means an attacker may be able to run code on a vulnerable server from a remote location. If exploitation is possible without authentication, the operational risk is significantly higher because internet-facing applications can become exposed without requiring a compromised user account first.

Why it matters for European businesses

Next.js is widely used to build modern websites, e-commerce front ends, SaaS products and content-driven platforms. For European SMEs and digital teams, a vulnerability in this framework can affect both customer experience and security posture.

The most immediate concern is that a successful remote code execution attack could lead to server compromise, service disruption, data exposure or lateral movement into connected systems, depending on deployment architecture. The denial-of-service issue adds another operational risk, particularly for companies that depend on their websites or applications for lead generation, online sales, support or partner access.

This also matters from a governance perspective. Businesses handling personal data, payment flows or regulated customer information may need to assess whether delayed patching increases their security and compliance risk, even if the reported issue itself is a software flaw rather than a regulatory change.

Who may be affected

The update is most relevant to organisations that use Next.js in production environments, including:

• Businesses running customer-facing websites or web applications built on Next.js
• E-commerce companies using Next.js for storefronts, headless commerce or checkout-related experiences
• Marketing teams operating campaign sites, landing pages or content platforms on modern JavaScript stacks
• IT and development teams managing self-hosted or cloud-hosted Next.js deployments
• Agencies and software partners maintaining Next.js websites for clients

Companies may also be indirectly affected if their website, portal or application is maintained by an external development supplier. In those cases, internal teams should confirm whether the vulnerable components are in use and whether the patch has been scheduled or already applied.

What companies should consider

• Identify exposure: Confirm whether any production, staging or internal applications rely on affected Next.js versions.
• Prioritise patching: Treat this as an urgent update for internet-facing services, especially where applications process user input or uploaded media such as SVG files.
• Review dependencies: Check related packages and deployment pipelines, including image-processing components such as sharp, to ensure updates are applied correctly.
• Assess monitoring: Increase logging and monitoring around application behaviour, unexpected process execution, unusual errors and spikes in traffic that could indicate attempted exploitation or denial-of-service activity.
• Coordinate with suppliers: If an agency, hosting provider or software vendor manages the application, request confirmation of impact, remediation timeline and post-patch validation.
• Validate recovery readiness: Ensure backups, rollback procedures and incident response contacts are current in case a compromise or service interruption is detected.

For many European businesses, the practical message is straightforward: if Next.js is part of your web stack, verify exposure quickly and patch without waiting for a routine maintenance cycle.