Next.js Security Update for Upstream Vulnerabilities

What it means in plain English

On 14 October 2026, Next.js published an out-of-band security update. The post says updates are available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS), and: "Please patch your Next.js dependencies to maintain the security of your applications." It names those two versions only. It does not name a patched release for any other line.

The same post describes three issues. This page stops at what that post says. It does not add exploit steps, and it does not say that any app was breached. It also does not say whether a Vercel-hosted app is protected.

1. Unauthenticated remote code execution in use cache functions that return typed arrays (critical). Next.js advisory GHSA-673q-mjm6-r5xr. Related upstream advisory GHSA-xqc2-xf4c-x3h3 (React). The post says a vulnerability in applications using App Router with Cache Components can lead to unauthenticated remote code execution when a use cache function returns multiple typed arrays. "There is no known workaround for affected applications. You should upgrade immediately even if your application does not have similar functions."
2. Unauthenticated remote code execution in the Image Optimization API when using SVG (critical). The Next.js post lists this as CVE-2026-96889 / GHSA-2464-fhr4-w9xw; the CVE ID is quoted from that post. The post says a memory-related vulnerability in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux. The workaround in that section is to ensure the version of sharp used by Next.js is 0.35.5 or later. "Upgrading Next.js to the patched versions ensures package managers automatically provide a fixed version of sharp to Next.js."
3. Denial of service in App Router using Server Actions (high). Next.js advisory GHSA-p3m5-59mp-jv5r. Related upstream advisory GHSA-h3gv-c5rc-p453 (React). The post says crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. That CPU usage blocks processing of further requests in the same process. "Applications using Pages Router or not using Server Actions are not vulnerable."

The "upgrade even if you do not have similar functions" sentence is in the use cache section. The Server Actions section says the opposite for apps that do not use Server Actions, and for Pages Router apps.

Source for every statement in this section: https://nextjs.org/blog/nextjs-security-update-october-14-2026 (opens in a new tab)

Likely causes

• next is older than 16.4.1 on the 16.4 line, or older than 15.5.28 on the 15.5 line. Those are the patched versions the 14 October 2026 post names.
• For the Image Optimization issue, Next.js is running on glibc-based Linux and the sharp version Next.js uses is older than 0.35.5. That workaround is only in the image section.
• For the Server Actions issue, the app uses the App Router and has at least one Server Action.
• For the use cache issue, the app uses the App Router with Cache Components. The post still says to upgrade immediately even when the app does not have similar functions, and it says there is no known workaround.

How to fix it, step by step

1. In the project directory, read the installed versions. npm's npm ls prints installed versions for the current working directory. Positional arguments limit the results to the packages you name, and nested packages show the paths to those packages. If node_modules is missing, --package-lock-only reads package-lock.json instead.

npm ls next sharp

2. With pnpm, pnpm list is pnpm ls. The default pnpm ls --depth 0 lists direct dependencies only, so pass --depth Infinity to list nested sharp. --lockfile-only (added in pnpm v10.23.0) reads the lockfile instead of node_modules.

pnpm list next sharp --depth Infinity

3. If you do not know the version, including an app from v0, Bolt, or Cursor, run that command in the project directory (the folder that has the app's package.json). Do not add -g. npm's global mode installs and lists against the prefix folder instead of the current working directory.
4. Match the printed next version to the command the post shows. # for 15.5 is npm install next@15.5.28. # for 16.4 is npm install next@16.4.1. On the 16.4 line, upgrade to 16.4.1 or later. pnpm's pnpm add page shows pnpm add sax@3.0.0 as the way to specify a version, so the matching form is pnpm add next@15.5.28 or pnpm add next@16.4.1. Install the line you are on. The post does not name a patched version for any other line, so do not invent one.
5. Commit the package.json and lockfile that the install changed. Vercel says it automatically redeploys your application when you make any commits: https://vercel.com/docs/deployments/managing-deployments (opens in a new tab)
6. That page also documents Redeploy from the dashboard: select the team in the team switcher, select the project, open Deployments, locate the deployment, click the ellipsis, select Redeploy, choose whether to use the existing Build Cache, then select Redeploy. That redeploys the deployment you located. The page's "When to Redeploy" list does not include a dependency upgrade. The commit in the previous step is what puts the patched next version into a new deployment.
7. If you run the Node.js server yourself, Next.js's deploying page says package.json should include "build": "next build" and "start": "next start". Then run npm run build and npm run start: https://nextjs.org/docs/app/getting-started/deploying (opens in a new tab)

npm ls details: https://docs.npmjs.com/cli/v11/commands/npm-ls/ (opens in a new tab)

pnpm list: https://pnpm.io/cli/list (opens in a new tab)

pnpm add: https://pnpm.io/cli/add (opens in a new tab)

The install commands for 15.5.28 and 16.4.1 are copied from https://nextjs.org/blog/nextjs-security-update-october-14-2026 (opens in a new tab)

How to check it worked

• npm ls next (or pnpm list next --depth Infinity) prints next@16.4.1 or later on the 16.4 line, or next@15.5.28 on the 15.5 line, matching the line you installed.
• npm ls sharp prints sharp at 0.35.5 or later. That is the image-section workaround. The post says upgrading to the patched Next.js versions makes the package manager provide a fixed sharp.
• The live site is a deployment made after the commit that contains that next version. On Vercel, a new commit is what triggers the automatic redeploy described above.

Questions people ask

Which Next.js versions fix the October 2026 security issues?

The 14 October 2026 post names v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS). It does not name a patched release for any other line.

How do I check which Next.js version my app uses?

Run npm ls next sharp in the folder that has the app's package.json, without -g. With pnpm, run pnpm list next sharp --depth Infinity.

Is there a workaround if I can't upgrade Next.js right away?

For the use cache issue, the post says there is no known workaround and to upgrade immediately. For the Image Optimization issue, the workaround is to make sure the sharp version Next.js uses is 0.35.5 or later.

Are Pages Router apps affected by the Server Actions issue?

No. The post says applications using Pages Router or not using Server Actions are not vulnerable.

Sources

• https://nextjs.org/blog/nextjs-security-update-october-14-2026 (opens in a new tab)
• https://docs.npmjs.com/cli/v11/commands/npm-ls/ (opens in a new tab)
• https://pnpm.io/cli/list (opens in a new tab)
• https://pnpm.io/cli/add (opens in a new tab)
• https://vercel.com/docs/deployments/managing-deployments (opens in a new tab)
• https://nextjs.org/docs/app/getting-started/deploying (opens in a new tab)