Next.js 16.4.1: two critical RCEs, one with no CVE id and no workaround, and GitHub's database lagged 8 days Three minutes and eleven seconds after the Next.js 16.4.1 package reached npm on 14 October, the advisory for its critical use cache flaw was published. GitHub's Advisory Database, the list Dependabot alerts read, listed it 7 days 22 hours later (derived). ⏱️ All five critical Next.js advisories of 2026 took between 7.9 and 14.2 days to reach that database (derived). 🆔 On 25 October the use cache flaw still has no CVE id, and Vercel states no known workaround. The Server Actions denial of service did get one: CVE-2026-94482, on 22 October. 📊 Three scores for one librsvg bug: 9.5 from Vercel, 8.9 from sharp and 7.8 from Red Hat. The 7.8 becomes 9.8 if its vector is network with no user interaction (recomputed, derived). CVE-2026-96889 was assigned by Red Hat to the library, not to Next.js. 📦 Next.js 15.5.28 still accepts sharp 0.34.x, so an existing lockfile can keep the vulnerable library after the upgrade. sharp 0.35.5 sat on npm 17 days before Next.js shipped its fix (derived). 🔎 Nothing read shows exploitation of the Next.js flaws. CISA's record does mark a public proof of concept for the librsvg bug itself. 🇬🇧 The NCSC window of 5 days for internet facing software closed on 19 October. The Cyber Essentials 14 day window ends on 28 October. ❓ Which feed would have told your team first? #NextJS #VulnerabilityManagement #SupplyChainSecurity #RCE #npm #React #JavaScript #Dependabot #CyberEssentials #NCSC #UKCyber #ThreatIntel #InfoSec #WebSecurity Full briefing: https://www.pk-sharma.com/briefing/nextjs-16-4-1-use-cache-rce-no-cve-id-no-workaround-github-feed-lagged-8-days