Next.js: critical flaws fixed in 2026, update to 15.5.28 or 16.4.1

In October 2026, Next.js published an out-of-band security update fixing two critical flaws that could let an attacker run code on the server without logging in, plus a high severity denial of service. It came after two earlier critical releases in August and September 2026, so a site updated during the summer may still need another update.

On October 14, 2026, the fixes covered remote code execution in Cache Components when a use cache function returns typed arrays (GHSA-673q-mjm6-r5xr), remote code execution in the Image Optimization API when processing SVG images on glibc-based Linux (CVE-2026-96889, caused by an upstream library used through sharp), and a denial of service in Server Actions. On September 22, 2026, Next.js fixed a remote code execution issue in the Node.js ImageResponse feature (next/og), used to generate social sharing images, in versions 16.2.0 to 16.3.5. On August 25, 2026, it fixed remote code execution through AVIF image optimization and a flaw affecting only Windows-hosted servers (CVE-2026-75604).

Who is affected

Sites and apps built with Next.js 15 or 16, especially those running on their own server (a VPS, Docker or a Node.js host) and using image optimization or Cache Components. Exposure depends on the features used and on where the site runs. Netlify, for example, says the next/image path is not used on its platform because its image CDN handles it, while apps using use cache with typed arrays are affected there too. These releases were published only for the 15.5 and 16 lines, so a site on an older line needs a larger upgrade.

How to check your site

Ask your developer, or open the project's package.json and look for "next" and its version. Vercel and Netlify dashboards also show the framework. As of this alert, the patched versions are 15.5.28 or later on the 15.5 line and 16.4.1 or later on 16.

What to do now

• Ask your developer to update next to 15.5.28 or 16.4.1, or later, and redeploy. This also brings a fixed version of sharp; Next.js gives sharp 0.35.5 or later as the workaround for the SVG flaw.
• If you are on Next.js 15.4 or older, plan a move to a supported line.
• On Netlify, delete old public deploy previews and branch deploys, which may stay vulnerable.
• Sites updated after October 14, 2026 are most likely protected, but check the version.

This alert reports what the sources published and is not a guarantee about any specific site.