Next.js patches two critical flaws and readies another release: what to do about your site

What happened

On October 14, 2026, the Next.js team published three security advisories on GitHub. Two are rated critical and one is rated high. The fixes shipped in version 16.4.1 and, for anyone still on the previous release line, in 15.5.28.

Almost two weeks later, on October 27, the team announced on its official blog another security release for November 3, with seven fixes rated medium. The details of those seven fixes come out together with the release.

What it means

Next.js is the tool behind a lot of modern websites and web apps. If your site were a building, Next.js would be the foundation and the frame: you don't see them, but everything else rests on them.

A vulnerability is a weak spot in that frame. What changes from one to the next is how serious it is:

• Critical means an outsider, with no username or password, could run code on the server that hosts your site. In practice, that's like handing them the keys to the building.
• High means the damage is serious but narrower, such as taking the site offline.
• Medium means the risk is real, but certain conditions usually have to line up before someone can exploit it.

These are the three October advisories:

1. SVG images (critical). A component Next.js uses to optimize images had a flaw that, on Linux servers, could let someone run code remotely. It affects versions 10 through 15.5.27 and 16 through 16.4.0.
2. The use cache function (critical). In apps that use use cache, a newer Next.js caching function, in a particular way, someone could run code on the server. The only fix is to upgrade. It affects 16.0.0 through 16.4.0.
3. Server Actions (high). With specially crafted requests, someone could overload the server until the site stopped responding. It affects 13 through 15.5.27 and 16 through 16.4.0, in apps that use the App Router and Server Actions.

How it affects you

The good. The flaws are already fixed, and the fix is the same for all three: upgrade Next.js. The Next.js team also announced the November release ahead of time, which gives teams room to plan for it.

The bad. The advisories are public. Since October 14, anyone can read which versions are vulnerable and go looking for sites that haven't been updated. A site that has gone months without maintenance is probably in the affected range.

If you don't use Next.js, none of this affects you. If you're not sure what your site is built with, ask whoever built it.

What you can do

1. Find out whether your site uses Next.js, and which version. Your technical team can check in a minute.
2. If it's older than 16.4.1 (or 15.5.28, on the 15 line), ask for the upgrade this week. Those are the minimum versions that fix the October flaws.
3. Plan for the November release too. Once it's out, ask to move to the version that includes the seven new fixes. If your team updates regularly, it will be a small step.
4. Ask them to test before going live. Security updates rarely break anything, but it's worth checking the main pages and forms.
5. Ask whether they have a maintenance plan. There were two rounds of fixes in under three weeks. A site that gets updated every month reaches each patch with a small jump.

Source

This post is based on official sources from the Next.js team: the Next.js security advisories on GitHub, from October 14, 2026, and the announcement Upcoming Next.js November Security Release, published on the Next.js blog on October 27, 2026.