The patch Vercel lined up on Saturday shipped on the 14th as 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). Two of the three fixes had been held back from the September release while the team coordinated with an upstream maintainer. The headline is CVE-2026-96889: a memory bug in the library behind Image Optimization that can turn a processed SVG into remote code execution on glibc-based Linux. A second critical, unauthenticated RCE hits App Router apps on Cache Components when a `use cache` function returns multiple typed arrays, and a high-severity bug lets crafted Server Actions requests peg a CPU and wedge the process. There's a catch worth knowing before you call this done. The Image Optimization fix only takes hold once the `sharp` your app actually resolves is 0.35.5 or later — bumping Next.js alone won't help if a stale lockfile pins an older decoder. Check the version in the running artifact, not just package.json. No exploitation has been reported in the wild yet, but two unauthenticated RCEs in LTS lines is not a patch to sit on.