Next.js Vulnerability 2026: How to Check, Fix and Verify Your App
This article was drafted with AI assistance and reviewed/edited by the author. Advisory and version data checked against GitHub Security Advisories, the Next.js blog, npm and NVD on 4 Nov 2026.
Short answer: On 14 Oct 2026 Next.js fixed two critical unauthenticated RCE bugs and one high-severity DoS (patched in 16.4.1 and 15.5.28). On 3 Nov 2026 seven more advisories were fixed in 16.4.5 and 15.5.29. Upgrade to the newest release on your line, 16.4.5 (16.x) or 15.5.29 (13.x–15.x), then redeploy.
Next.js vulnerability 2026: what was disclosed
The 14 October batch (vercel/next.js advisories):
GHSA-2464-fhr4-w9xw: RCE in Image Optimization API with SVG files (references upstream librsvg CVE-2026–96889) — Severity: Critical; Affected: 10.0.0–15.5.27, 16.x ≤16.4.0; Fixed in: 15.5.28 / 16.4.1
GHSA-673q-mjm6-r5xr: RCE in use cache functions returning typed arrays — Severity: Critical; Affected: 16.0.0–16.4.0; Fixed in: 16.4.1
GHSA-p3m5–59mp-jv5r: DoS in App Router using Server Actions — Severity: High; Affected: 13.0.0–15.5.27, 16.0.0–16.4.0; Fixed in: 15.5.28 / 16.4.1
The 3 November security release (patched in 16.4.5 and 15.5.29): HttpOnly cookie exposure on Edge routes (CVE-2026–119346), SVG rejection bypass in image optimization (CVE-2026–119347), cross-client response injection when self-hosted apps forward fetched responses (CVE-2026–119348), and four use cache / Cache Components cache leak or poisoning issues (CVE-2026-119349, -119350, -119351, -119790). The Next.js blog rates the unstable_cache + use cache cross-tenant disclosure (GHSA-mfr8-8qww-v76h) High, while its GitHub advisory says Medium. The other six are Medium in both.
This was not a one-off. On 25 Aug 2026 two critical RCEs (AVIF image handling, and CVE-2026–75604 on Windows-hosted servers) were fixed in 15.5.24 / 16.3.3. On 22 Sep a critical RCE in next/og ImageResponse (CVE-2026-94545) was fixed in 16.3.6. On 30 Sep eight more advisories landed, including SSRF in Image Optimization (CVE-2026-94483) and SSG/ISR cache poisoning (CVE-2026-94543, CVE-2026-94484).
I found no official statement on exploitation in the wild, so treat these as “patch now”, not “already exploited”.
Next.js vulnerability check: which version am I on?
npm ls next # or: pnpm why next / yarn why next
npx next --versionIn a monorepo, check every app. Your lockfile is the truth, not the ^ range in package.json.
Next.js vulnerability fix: upgrade commands
# Next.js 16
npm install next@16.4.5
# Next.js 13, 14, 15 (backport line)
npm install next@15.5.29
Same idea for pnpm add / yarn add. Rebuild and redeploy, because a new lockfile does nothing until the build ships. On 13.x or 14.x, the advisories list 15.5.28+ as the patched path, so jumping to 15.5.29 is a major upgrade. Test it in staging first.
Next.js vulnerability workarounds if you can’t upgrade today
These reduce exposure. They do not replace the patch:
• Image Optimization (SVG RCE): the Next.js team’s workaround is making sure the sharp version Next.js uses is 0.35.5 or later (the bug affects glibc-based Linux). Setting images: { unoptimized: true } also avoids the optimizer if you don't need it.
• use cache RCE: the Next.js team says there is no known workaround. Upgrade.
• Server Actions DoS: only App Router apps with at least one Server Action are affected. Add rate limits and request body size limits at your proxy/WAF.
Get Raghav Ji’s stories in your inbox
Join Medium for free to get updates from this writer.
• Read each advisory’s own “Workarounds” section. Some list none.
Next.js middleware bypass: is that this bug?
No. People still search “next js middleware bypass vulnerability” because of CVE-2025–29927 (March 2025), where a crafted x-middleware-subrequest header skipped middleware. It was fixed in 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3 (advisory). Lesson: don't let middleware be your only auth check. Check the session again in the route or Server Action.
Next.js vulnerability patch: how to verify you’re patched
npm ls next # should show 16.4.5 or 15.5.29
npm audit --omit=dev # should no longer list next advisoriesCheck the deployed build, not just your laptop: look at the CI log for the installed version, or run npx next info in the build environment. Turn on Dependabot or Renovate so the next advisory arrives as a PR.
FAQs
Is Next.js 15 affected?
Yes. The SVG image RCE and Server Actions DoS affect 15.x up to 15.5.27, and several 3 Nov advisories list 15.x up to 15.5.28. Upgrade to 15.5.29.
I’m on Vercel. Do I still need to upgrade?
Yes. The fixes ship in the next package, so upgrade and redeploy. Some 3 Nov issues only affect self-hosted apps, but the October RCE advisories do not say that.
What is the latest safe Next.js version?
As of 4 Nov 2026, npm latest is 16.4.5 and backport is 15.5.29.
Does npm audit catch this?
It reads the GitHub Advisory Database. Very new advisories can take time to appear there, so also confirm with npm ls next.
Was CVE-2025–29927 fixed again?
No. That middleware bypass was fixed in March 2025.
Side note: I review upgrade notes like these with prompts from my free PromptPilot app, which helps you write better prompts for coding assistants.
Sources
• Next.js security advisories (GitHub): https://github.com/vercel/next.js/security/advisories
• CVE-2025–29927 advisory: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
• NVD CVE-2026–96889 (librsvg): https://nvd.nist.gov/vuln/detail/CVE-2026-96889
• npm next versions: https://www.npmjs.com/package/next?activeTab=versions
• Next.js blog, 14 Oct 2026 update: https://nextjs.org/blog/nextjs-security-update-october-14-2026
• Next.js blog, November 2026 security release: https://nextjs.org/blog/november-2026-security-release
