BREAKING: Next.js October 2026 security update fixes two unauthenticated RCEs. Check sharp too (CVE-2026-96889)

How to fix CVE-2026-96889: upgrade next to 16.4.1 or 15.5.28 and make sure sharp is 0.35.5. Two Next.js RCEs and a DoS fixed Oct 14.