Vercel shipped an out-of-band Next.js security release on Oct 14 with fixes held back from September. (1) GHSA-673q-mjm6-r5xr (with React advisory GHSA-xqc2-xf4c-x3h3): critical unauthenticated RCE in App Router apps using Cache Components when a use cache function returns multiple typed arrays; no workaround, and Vercel says upgrade even if you have no such function. (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw: critical unauthenticated RCE through the Image Optimization API when SVGs are processed, caused by a memory bug in an upstream library (librsvg via sharp) on glibc-based Linux; workaround is sharp 0.35.5 or later. (3) GHSA-p3m5-59mp-jv5r: high-severity CPU-exhaustion DoS in App Router apps with Server Actions. Fixed in 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). Vercel did not report exploitation; not on CISA KEV as of catalogVersion 2026.10.14.