Next.js Security Updates 2026: What to Patch Now

Next.js Security Updates 2026: What to Patch Now

Last updated: 5 November 2026.

Next.js has had a busy autumn. On 14 October 2026, the framework published an out-of-band release fixing two critical vulnerabilities that could allow remote code execution without authentication, along with a high-severity denial-of-service flaw. Less than three weeks later, on 3 November, a scheduled release fixed seven more vulnerabilities, rated medium, most of which involve caching and data leaking between users. The two releases are cumulative in one important way: version 16.4.1, which fixed the October issues, does not include the November fixes. If you run Next.js in production, the versions to be on today are 16.4.5 or 15.5.29. This article explains what each release fixed and what else you need to do beyond updating the package.

The October Release: Two Critical Remote Code Execution Flaws

The 14 October release addressed three issues, including fixes coordinated with React for related upstream problems:

• Remote code execution in use cache functions (critical). Affects Next.js 16.0.0 to 16.4.0 in App Router applications that use Cache Components, under specific conditions involving cached functions that return typed arrays. There is no workaround other than upgrading.
• Remote code execution through SVG processing, CVE-2026-96889 (critical). A memory-safety bug in librsvg, the SVG library bundled with sharp, which Next.js uses for image optimization. Next.js rates it 9.5 on the CVSS scale. It affects Next.js 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0 on glibc-based Linux when untrusted SVG input is processed.
• Denial of service in Server Actions (high). Affects App Router applications with at least one Server Action, in Next.js 13 through 16.4.0. Pages Router applications are not affected.

These issues were fixed in Next.js 16.4.1 and 15.5.28. At the time of the release, no exploitation in the wild had been publicly reported, but researchers noted that the upstream sharp fix had been public since late September, giving attackers time to study it.

The November Release: Seven Cache and Data Exposure Issues

The 3 November release fixed seven medium-severity vulnerabilities. Individually they are less dramatic than remote code execution, but several can expose one user's data to another, which is a serious problem for any application with logged-in users. The fixed issues include:

• Cache leaks across root parameter values in nested use cache functions, and information disclosure through unstable_cache() in applications using Cache Components.
• Cross-user cache disclosure and cache poisoning when cached functions receive binary arguments such as Blob.
• Cache poisoning of shared fallback shells, which could cause valid pages to return cached 404 responses.
• Exposure of HttpOnly cookies on Edge runtime route handlers and API routes.
• A bypass of SVG rejection in image optimization when dangerouslyAllowSVG is set to false.
• Cross-client response injection in self-hosted App Router applications behind certain reverse proxies.

All seven are fixed in Next.js 16.4.5 and 15.5.29. Fixes were released for the 16.4 and 15.5 lines; applications on older major versions need to upgrade to a supported line to receive them.

Who Needs to Act

The safest assumption is that every production Next.js application should be upgraded, but some setups carry more risk than others. Applications using the App Router with Cache Components and use cache are affected by the most issues across both releases. Applications that process user-supplied images or SVGs are exposed to the critical image vulnerability. Applications that run Edge route handlers and set HttpOnly cookies, and self-hosted deployments behind reverse proxies, are affected by specific November issues.

Being on a managed platform does not automatically protect you. Hosting providers such as Netlify have published platform-specific guidance, and in some cases the platform adapter must also be updated or caches purged for the fix to take full effect.

How to Upgrade Correctly

• Upgrade the package. Update next to 16.4.5, or to 15.5.29 if you are on the 15.x line, along with the matching React versions recommended in the advisories.
• Rebuild and redeploy. The image optimization fix reaches your application through an updated sharp dependency during the build, so a new build is required, not just a package.json change.
• Verify what actually shipped. Check the lockfile and run npm ls sharp and npm ls next to confirm the resolved versions in the deployed build.
• Update platform adapters. If your host uses an adapter or plugin for Next.js, make sure it is on the version recommended in the host's advisory.
• Restart long-running processes. For self-hosted deployments, restart every Node.js process so the new code is loaded.

Beyond the Upgrade: Caches, Previews, and Scanners

Because several November issues involve cache poisoning and disclosure, upgrading does not remove data that may already be cached. After deploying the fix, purge your CDN and application caches, including caches for preview and branch deployments, so that poisoned or leaked responses are not served again.

Old preview and branch deployments are another easily forgotten risk. They often remain publicly accessible and keep running the vulnerable version until they are deleted, so remove the ones you no longer need. Finally, be aware that some advisories were published with GitHub advisory identifiers rather than CVE numbers. Vulnerability scanners that rely only on CVEs may not flag them, so check the Next.js and React security advisories directly instead of relying on a clean scan.

If You Cannot Upgrade Immediately

Upgrading is the only complete fix, but some exposure can be reduced in the meantime. For the image vulnerability, pinning sharp to version 0.35.5 or later, blocking SVG decoding, and disabling dangerouslyAllowSVG where it is not needed lower the risk. Running Node.js with the least privileges possible and keeping image processing isolated from application secrets limit the damage if a flaw is exploited. Treat these as short-term measures and schedule the upgrade as soon as possible.

Making Security Releases Routine

Next.js now announces scheduled security releases in advance and ships out-of-band fixes for critical issues. The teams that handle this well have a few things in common: automated dependency updates, a test suite that gives confidence to upgrade quickly, a staging environment that mirrors production, and someone responsible for watching advisories. With that foundation, a security release becomes a routine afternoon task rather than an emergency.

Frequently Asked Questions

Which Next.js version should I be on now?

Next.js 16.4.5 for the 16.x line or 15.5.29 for the 15.x line. These versions include both the 14 October fixes and the seven fixes released on 3 November 2026.

I upgraded to Next.js 16.4.1 in October. Am I safe?

No. Version 16.4.1 fixed the October vulnerabilities, but not the seven issues fixed on 3 November. You need to upgrade again to 16.4.5, or to 15.5.29 on the 15.x line.

What is CVE-2026-96889?

CVE-2026-96889 is a critical remote code execution vulnerability in the SVG processing used by Next.js image optimization, caused by a memory-safety bug in librsvg, which is bundled with the sharp library. It affects glibc-based Linux systems that process untrusted SVG input and is fixed in Next.js 16.4.1, 15.5.28, and later.

Are Next.js 14 and older versions affected?

Some of the issues, such as the image vulnerability and the Server Actions denial of service, affect older versions as well. Fixes were released for the 15.5 and 16.4 lines, so applications on older major versions should upgrade to a supported line.

Do I need to clear my cache after upgrading?

Yes, if your application uses caching. Several November vulnerabilities involve cache poisoning or leaking cached data between users, and upgrading does not remove responses that are already cached. Purge CDN and application caches after deploying the fix.

Are applications on Vercel or Netlify protected automatically?

Not entirely. Hosting platforms may mitigate some issues at the infrastructure level, but you still need to upgrade Next.js, redeploy, and follow your platform's guidance, which may include updating an adapter or purging caches.

Is the Pages Router affected?

Some issues are specific to the App Router, such as the Server Actions denial of service and the Cache Components issues. The image optimization vulnerability can affect applications regardless of router. Upgrading is recommended in all cases.

Conclusion

Two Next.js security releases in three weeks are a reminder that modern frameworks need active maintenance. Upgrade to 16.4.5 or 15.5.29, rebuild so the updated image libraries are included, verify the resolved versions, purge caches, and remove old preview deployments. If you need help upgrading a Next.js application safely, reviewing its caching and security setup, or putting a reliable maintenance process in place, our team works with Next.js every day and can help you stay ahead of the next release.