Server-side Next.js apps run on machines like these, so patching them matters. Photo: BalticServers.com, CC BY-SA 3.0, via Wikimedia Commons
If your company website, web app or online store was built with Next.js, the framework has had three out-of-band security releases in under two months. Each one fixed issues that Vercel, the maintainer, rated Critical. This post explains what was fixed, who needs to act, and how to avoid scrambling each time.
The short answer
Vercel published security updates for Next.js on 25 August, 22 September and 14 October 2026. The latest one fixes two Critical issues and one High issue in Next.js 16.4.1 and 15.5.28. If your site runs Next.js on a server, upgrade to one of those releases or later, then redeploy. Check with your developer which features your app uses, because each advisory depends on specific conditions. Then agree a monthly patch routine so the next release is a ten-minute job.
What was fixed, release by release
25 August 2026: versions 15.5.24 and 16.3.3
Netlify's summary of the release describes two Critical advisories, both unauthenticated remote code execution:
- CVE-2026-75604 affected Windows-hosted servers, in versions from 13.4.0 up to before 15.5.24 and from 16.0.0 up to before 16.3.3.
- GHSA-2xp9-vwfh-vxw4 affected the Image Optimization API when AVIF files are used.
Both are patched in 15.5.24 and 16.3.3.
22 September 2026: versions 16.3.6 and 15.5.26
Vercel reported a Critical issue in the Node.js ImageResponse implementation in next/og, tracked as GHSA-vcvr-r3jv-pc5j. Affected versions were 16.2.0 up to before 16.3.6. Vercel says applications using the Edge ImageResponse implementation are not affected, and that Next.js 15.x is not affected by the remote code execution issue, though 15.5.26 includes related hardening.
14 October 2026: versions 16.4.1 and 15.5.28
This update included two fixes that Vercel says were postponed from the September release because of delays in upstream dependencies:
- Critical: unauthenticated remote code execution in
use cachefunctions that return multiple typed arrays, in apps using the App Router with Cache Components (GHSA-673q-mjm6-r5xr, with a related React advisory). Vercel says there is no known workaround and recommends upgrading immediately, even if your application does not have similar functions. - Critical: remote code execution in the Image Optimization API when using SVG (CVE-2026-96889, GHSA-2464-fhr4-w9xw), caused by a memory issue in an upstream library when Next.js runs on glibc-based Linux. The workaround is to make sure the
sharppackage used by Next.js is version 0.35.5 or later, and upgrading Next.js lets package managers provide a fixed version automatically. - High: denial of service in the App Router with Server Actions (GHSA-p3m5-59mp-jv5r). Crafted requests can cause excessive CPU use. Vercel says applications using the Pages Router, or not using Server Actions, are not vulnerable.
Who is affected
The conditions matter, which is why the answer is "ask your developer" and not "everyone panic":
| Question | Why it matters |
|---|---|
| Does the app run on a server, rather than being a purely static export? | The advisories describe server features such as image optimization and Server Actions. |
| Which router does it use? | Some issues apply to the App Router only. |
Does it use image optimization, next/og, Cache Components or Server Actions? |
Each issue maps to one of these features. |
| Where is it hosted? | Hosts such as Netlify have said certain paths are not run on their platform, but still recommend upgrading. |
If you are unsure, assume you are affected and upgrade. The upgrade is a normal dependency update for most projects.
How to check your version
Your developer can do this in a minute. In the project folder, the command npm ls next prints the installed Next.js version, and the package.json file shows the version range the project asks for. The lockfile records the exact version that gets installed, so a build can still use an older release than you expect if the lockfile was not refreshed. Compare the result with the fixed versions above, which are per release line: 16.4.1 for the 16.4 line and 15.5.28 for the 15.5 line.
If your site was built by an agency, ask them for three things in writing: the Next.js version in production today, the date it was last updated, and which of the features above the app uses. A good agency can answer within a day. If they cannot, that is a sign that updates are not part of the arrangement, and it is worth adding them to the contract or a maintenance plan.
Questions to put to your developer
- Is the site a server-rendered Next.js app, or a static export with no running server?
- Do we use the App Router or the Pages Router?
- Do we use image optimisation,
next/og, Cache Components or Server Actions? - Where is it hosted, and has the host published a notice for these releases?
- Who is responsible for the next update, and how will we hear that it is done?
Short answers to these let you judge the risk without reading an advisory yourself.
A patch routine that works
A routine turns a security release into a calendar item. You do not need special tools for this:
- Know what you run. Keep a list of every site and app, the framework and its version, and the host.
- Subscribe. Follow the Next.js blog and your hosting provider's changelog, and add a reminder for the second week of each month.
- Update in a branch. Install the patched version, run the build and tests, and check key pages.
- Deploy, then verify. Redeploy and confirm the live site responds and key forms work.
- Record it. Note the date and version, so you can answer a customer or insurer asking when you patched.
Our website maintenance guide covers the wider routine, including backups, access and monitoring. If you are choosing between frameworks, see how Next.js compares with WordPress for a business website, and our website development service page explains what ongoing care we offer.
Common mistakes
- Updating the lockfile but not redeploying. The fix only applies once the new build is live.
- Skipping versions because the site "works". Several of these issues are rated Critical and unauthenticated.
- Ignoring dependencies. The October image issue came from an upstream library, which is why the
sharpversion matters. - Assuming your host handles everything. Platforms differ, and Netlify's own notice still recommended upgrading.
- Having no owner. If nobody is responsible for updates, nobody does them.
Checklist
- Find out which Next.js version each site or app runs
- Upgrade to 16.4.1 or later (16.x) or 15.5.28 or later (15.x)
- Confirm
sharpis 0.35.5 or later if you use image optimization - Redeploy and check the live site
- Ask your developer whether you use Server Actions, Cache Components or
next/og - Add a monthly reminder to check security releases
- Name one person responsible for framework updates
Key takeaways
- Next.js had three out-of-band security releases between August and October 2026, with Critical issues in each.
- The newest fixes are in 16.4.1 and 15.5.28; for the typed-array
use cacheissue there is no known workaround. - Whether you are affected depends on your features and hosting, so ask your developer.
- A monthly patch routine and a named owner make future updates routine.
Sources
- Vercel, Next.js Security Update for Upstream Vulnerabilities, 14 October 2026: https://nextjs.org/blog/nextjs-security-update-october-14-2026
- Vercel, Next.js Security Update for a Critical Upstream Issue, 22 September 2026: https://nextjs.org/blog/nextjs-security-update-september-22-2026
- Netlify, Next.js security release (August 2026): what to know, 25 August 2026: https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/
