Next.js security releases: October fixes and the 3 November patch

Next.js now ships security fixes on a schedule, and the next scheduled release lands on Tuesday 3 November 2026, covering seven medium severity vulnerabilities. It follows a busy autumn: since mid September there have been two out-of-band updates and one scheduled release, including fixes for three critical remote code execution issues. If your Next.js app is not on 16.4.1 or later (or 15.5.28 or later on the 15.x line), you are running versions with publicly disclosed critical vulnerabilities and should patch now.

This article summarises what has been fixed, how the new release programme works and how to fit it into your maintenance routine. It is general information, not security advice for your specific set-up.

How the Next.js security release programme works

On 13 July 2026 the Next.js team announced a formal security release programme, replacing occasional ad-hoc patches that arrived without warning. The team pointed to a rise in vulnerability research across the industry, much of it assisted by AI tools, as one reason for the change.

• Advance notice. Roughly once a month, the Next.js blog announces an upcoming security release, with the expected date and the highest severity among the issues it covers.
• Full details on release day. Advisories, affected versions and upgrade commands are published when the patches go out.
• Out-of-band patches still happen. Urgent issues, or vulnerabilities already being exploited, get ad-hoc releases, also announced on the blog.
• Coordination with hosts. The lead time lets hosting providers deploy mitigations such as firewall rules for apps that have not patched yet.

Patches are published for the Active LTS line (Next.js 16) and the Maintenance LTS line (Next.js 15). According to the Next.js support policy, 15.x will receive security releases until 31 January 2027. Next.js 14 and earlier are unsupported and receive no fixes.

What has been fixed since September

The October 14 update in more detail

The October update is the one most teams should check first, because two issues were rated critical.

Remote code execution in use cache functions

Apps using the App Router with Cache Components could be exposed to unauthenticated remote code execution when a use cache function returns multiple typed arrays. The advisory (GHSA-673q-mjm6-r5xr) says there is no workaround and recommends upgrading even if your app has no functions like this. A related advisory was published by React for the underlying Server Components code.

Remote code execution in Image Optimization with SVG

A memory-related flaw in an upstream image library could lead to remote code execution when Next.js runs on glibc-based Linux, which covers many common server and container images (CVE-2026-96889). The workaround is to make sure the sharp package used by Next.js is version 0.35.5 or later. Upgrading Next.js to a patched version pulls in a fixed sharp automatically.

Denial of service with Server Actions

Crafted requests to App Router apps with at least one Server Action could cause excessive CPU usage and block other requests in the same process. Apps using only the Pages Router, or no Server Actions, are not affected.

Self-hosted apps deserve extra attention

Several recent advisories depend on how and where Next.js is deployed. The September release, for example, fixed a cache poisoning issue (CVE-2026-94543) in self-hosted Pages Router apps using SSG or ISR; apps deployed on Vercel were not affected. The SSRF issue in Image Optimization (CVE-2026-94483) only applied to apps with images.remotePatterns configured.

The practical point: managed platforms may roll out mitigations at the network edge before you patch, but a Next.js app running on your own server, a VPS or a container platform usually has no such protection. For self-hosted apps, the gap between disclosure and patching is entirely in your hands.

Treat the monthly Next.js security release like a scheduled maintenance window, not a surprise.

Context: why this matters after React2Shell

The new programme follows the React Server Components vulnerability disclosed in December 2025, widely known as React2Shell (CVE-2025-55182 in React, tracked for Next.js as CVE-2025-66478). It allowed unauthenticated remote code execution and was fixed in React 19.0.1, 19.1.2 and 19.2.1, followed on 11 December by fixes for denial of service and source code exposure issues. Since then, several of the most serious Next.js issues have come from upstream dependencies such as React, Satori and image libraries, which is why keeping the whole dependency tree current matters as much as the framework version itself.

What to do next

1. 1 Check your version. Run npm ls next (or the equivalent for your package manager) in every project, including staging and preview environments.
2. 2 Patch to the latest release on your line. At the time of writing (November 2026), that is 16.4.3 on the 16.x line, published on npm as latest, and 15.5.28 on the 15.x line. Plan to apply the 3 November release once it is out.
3. 3 Check transitive dependencies. Confirm sharp resolves to 0.35.5 or later and that react and react-dom are current. npm audit and GitHub Dependabot alerts help here.
4. 4 Diary the schedule. Watch the Next.js blog or subscribe to the repository's security advisories so you see each advance notice, and book time for a patch, build, test and deploy cycle.
5. 5 Plan your way off unsupported versions. If you are on Next.js 14 or earlier, there are no fixes coming. If you are on 15.x, the security window closes on 31 January 2027.
6. 6 Turn on upgrade reminders. Next.js 16.4 adds experimental.agentUpgrade; its default 'security' policy reminds you during next dev and next build when an upgrade fixes a known vulnerability in your installed version.

Frequently asked questions

Is my site affected if it is hosted on Vercel?

Some issues, such as the September Pages Router cache poisoning bug, did not affect Vercel deployments, and hosts may deploy firewall mitigations ahead of releases. Many issues affect every deployment, though, so you should still upgrade.

We use the Pages Router only. Do we need to patch?

Yes. Some advisories only affect the App Router, but others, including Image Optimization and SSG or ISR caching issues, apply to Pages Router apps too. Read each advisory or simply stay on the latest patch.

How often will these releases come?

The Next.js team says roughly once a month, with advance notice on its blog, plus out-of-band releases when an issue cannot wait.

The bottom line

Next.js security patching has become predictable, which makes it easier to plan for. The teams that will cope best are the ones with a simple, repeatable routine: check the blog, upgrade on a branch, run the build and tests, deploy. If that routine does not exist yet, the 3 November release is a good time to start it.

Sources: Next.js security release programme, Upcoming November security release, October 14 security update, September 2026 security release, September 22 security update, Next.js support policy, React: critical vulnerability in React Server Components.