Between 25 August and 30 September 2026 the Next.js team shipped three security updates that fix ten vulnerabilities: two on 25 August, one on 22 September, seven on 30 September. Three were critical and allowed code to be run on the server remotely, the two from August without any need to log in. If your website or online shop is built with Next.js, the version of next should be 16.3.8 (line 16.3) or 15.5.27 (line 15.5), and the site has to be redeployed after the update. Two fixes, one critical and one high severity, were postponed and have not been released yet.
Timeline of the updates
- On 25 August the team released 16.3.3 and 15.5.24, fixing two critical flaws. The first is in AVIF image optimisation: a file crafted by an attacker can make the server run code, because of a flaw in libheif, a library used by
sharp. The second affects servers with a Windows file system when the app uses the Pages Router and the App Router together without Cache Components. Both versions switched AVIF optimisation off; 16.3.4 brought it back on 31 August. - On 22 September, out of schedule, the team released 16.3.6 and 15.5.26 for a critical flaw in
ImageResponsefromnext/og, the function that generates images on the fly. It concerns the Node.js implementation, from 16.2.0 to 16.3.5, and only apps that put values an attacker can control into the image, for example a URL parameter. The Edge implementation is not affected; 15.x is not hit and only gets hardening. - On 29 September 16.3.7 came out with a bug fix and no security patches. On 30 September 16.3.8 and 15.5.27 followed, with seven fixes (one high, five medium, one low).
- On 6 October Next.js 16.4 was released: the announcement presents new features and tools, lists no security advisories and does not mention the two postponed fixes.
The 30 September release
| Issue | Severity | When it concerns a site |
|---|---|---|
| Requests to internal addresses from the image optimiser (SSRF) | High | External domains in images.remotePatterns |
| Static pages showing the content of another page | Medium | Self-hosting, Pages Router with SSG or ISR |
| Shared cache poisoned by a single request | Medium | Root-level catch-all page with SSG or ISR |
Metadata images (opengraph-image) that ignore dynamicParams | Medium | App Router built with webpack |
| Nested cache serving the content of another root parameter | Medium | Cache Components with nested use cache |
| Unpublished content shown to visitors | Medium | Cache Components with draft preview (Draft Mode) |
| Project data read by a malicious website | Low | Development server only (next dev) |
The high severity flaw only concerns whoever has allowed domains in images.remotePatterns, and the risk comes from a listed domain that an attacker can control. According to Netlify, images, metadata, nested cache, drafts and the development server touch only Next.js 16, while the two static-page cache flaws also touch 15. Netlify adds that four of the seven apply to sites on its platform (metadata, nested cache and the two static-page cache flaws) and three do not (images, drafts and the development server).
What it means for your site
- On a Windows server the August flaw can be exploited if the app uses the Pages Router and the App Router together without Cache Components, and no workaround is known: you need the update. It does not apply on Linux and macOS; for the AVIF flaw the advisories state no conditions on the operating system.
- Vercel writes that apps on its platform were protected from the two August flaws with no action needed. According to the Next.js team the Pages Router cache flaw does not affect apps on Vercel. Vercel's note does not cover the September flaw in
ImageResponse. - On Netlify you need the right version of
nextand, if you pinned it by hand, the@netlify/plugin-nextjsadapter at 5.16.1. Netlify suggests deleting old deploy previews by hand, because they can stay vulnerable.
For self-hosted servers and the August flaws, Vercel names 15.5.24 for Next.js 15 or earlier and 16.3.3 for 16: anyone on an older version, such as 14, or on a 16.x before 16.3 finds no patch in their own line and has to change line. For the September flaws you need 16.3.8 or 15.5.27. In our view it is better to stay on your own line and take the latest patch: 16.4 is a version upgrade to be tested, and the team does not say whether it contains all the September fixes.
What to ask whoever runs the site
- Which version of
nextis running in production? It can be read inpackage.jsonand the lock file. - Has the site been redeployed since the update? The live site only changes with a new deployment.
- Where does the site run, and what has the hosting provider already applied?
- Does it use
images.remotePatterns, with which domains? Does it generate images withImageResponsefrom text that comes from the URL or from visitors? - Who follows the security advisories? The last two scheduled releases were announced on the Next.js blog about a week earlier.
What we look at on a Next.js site
Our own website is built with Next.js. In our websites and e-commerce service, maintenance continues after delivery, and an advisory like these belongs to that phase. A catalogue with images on another domain, for example, falls under the high severity flaw.
If you ask us for a check, we start from four points: the version of next in the lock file, compared with the ones in this article; the hosting and what the provider has already applied; the features the advisories touch (external domains for images, images generated from text in the URL, pages regenerated on your own server, drafts with Cache Components); the date of the last deployment. We share decisions with you before we put them into effect.
The check needs access to the code and the hosting. We cannot tell from outside whether a third-party provider has already applied its protections, nor when the fix for the two postponed flaws will come out.
What we do not know yet
- The team has given no date for the two postponed fixes.
- The announcements do not describe the postponed critical flaw, so we cannot say whether it concerns features you use.
- The 6 October announcement does not say whether 16.4 contains all the September fixes.
If you want us to look at your site, get in touch and tell us the address, the hosting and the Next.js version: we work on websites and e-commerce.
Sources
- Next.js: August 2026 Security Release (25 August 2026)
- Vercel: Vercel applications are protected from Next.js August 2026 security vulnerabilities (25 August 2026)
- GitHub (vercel/next.js): Release v16.3.4 (31 August 2026)
- Next.js: Next.js Security Update for a Critical Upstream Issue (22 September 2026)
- GitHub (vercel/next.js): Remote Code Execution in next/og ImageResponse (GHSA-vcvr-r3jv-pc5j) (22 September 2026)
- Next.js: Upcoming Next.js September Security Release (23 September 2026)
- Next.js: September 2026 Security Release (30 September 2026)
- Netlify: Security Update: Multiple vulnerabilities in Next.js (30 September 2026)
- Next.js: Next.js 16.4 (6 October 2026)
