Next.js: two security releases in three weeks. Update now

If you run a Next.js site, this is the update to schedule this week. The team shipped two security releases in three weeks.

14 October: out-of-band update

Versions 16.4.1 and 15.5.28 fixed three issues in upstream dependencies:

• Critical: remote code execution in use cache functions that return several typed arrays (App Router with Cache Components). There is no workaround.
• Critical: remote code execution in Image Optimization when handling SVG on glibc-based Linux, via the image library. The fix requires sharp 0.35.5 or later.
• High: denial of service in App Router apps that use Server Actions.

3 November: scheduled release

Versions 16.4.5 and 15.5.29 fixed seven more issues, one High and six Medium. Most involve Cache Components serving cached content to the wrong tenant, site or user. Others cover a cookie value that same-origin JavaScript could read in Edge routes, and an SVG check in Image Optimization that could be bypassed.

What to do

npm install [email protected]   # on 16.x
npm install [email protected]  # on 15.5

Then rebuild and redeploy. If your app is multi-tenant or uses use cache, give it priority.

Sources

• Next.js Security Update for Upstream Vulnerabilities (Next.js blog, 14/10/2026)
• November 2026 Security Release (Next.js blog, 3/11/2026)