October 28, 2026

A critical Next.js RCE vulnerability, tracked as CVE-2026-96889, lets attackers run code via untrusted SVG files. Vercel disclosed the flaw on October 14, 2026, rating it Critical with a CVSS