Next.js Releases Security Updates for Versions 15.5 and 16.3

On September 30, 2026, Next.js released security updates 16.3.8 and 15.5.27. According to the Next.js Blog, fixes for one critical and one high-severity vulnerability had previously been delayed because of a dependency issue. The team now recommends updating Next.js in your applications. The issues include cache poisoning, information disclosure, and server-side requests through image optimization.

Which applications are affected

Version 16.3.8 is for the Active LTS branch, while 15.5.27 is for Maintenance LTS. Not every vulnerability described here affects every Next.js project: the conditions depend on image settings, hosting, the router, the bundler, and caching features.

The high-severity Image Optimization vulnerability involves remote images. If an attacker controls a URL allowed by the application's settings, the server may send a request to it—for example, to an address in a private IP range. This is Server-Side Request Forgery, or SSRF. Applications without images.remotePatterns configured are not affected by this issue.

Several bugs involve the page cache. In a self-hosted application using the Pages Router and SSG or ISR pages, the cache entry for one page can be replaced with content from another route. Visitors will see the wrong content until the entry is revalidated. Applications on Vercel are not affected by this issue.

Another case involves a root catch-all route combined with statically generated routes or ISR. A single specially crafted unauthenticated request can affect the shared response cache. With Cache Components enabled, nested use cache functions sometimes generate a key without the root route parameter. Content for one parameter value can then appear in the response for another. The attacker cannot choose which values are exposed.

Editorial previews are also at risk. If a site uses Cache Components or experimental.useCache, and cached functions return data that depends on Draft Mode, simultaneous requests from an editor and a visitor may share the same in-progress cache fill. The visitor could receive unpublished content without authorization. If a page is also prerendered, the draft may be stored in it and shown to other visitors until revalidation.

Two further issues involve access to information. In the App Router, metadata image routes, including opengraph-image and twitter-image, ignore the dynamicParams setting in webpack builds. As a result, images can be requested for dynamic segments excluded from generateStaticParams(). Turbopack builds are not affected. The other bug exists only in next dev: a malicious website opened by a developer can use the Model Context Protocol endpoint to obtain the project path, code snippets from error messages, a list of routes, and logs. This endpoint is not served in production deployments.

What the site team should check

The first step is to identify which Next.js branch the project uses and install the corresponding update: [email protected] for 16.3 or [email protected] for 15.5. Then compare the application's configuration with the conditions for each vulnerability rather than drawing conclusions simply because it uses Next.js.

For a site that uses external images, the images.remotePatterns setting matters. For a self-hosted project using the Pages Router, check whether it has SSG or ISR pages. Teams using Cache Components and Draft Mode should separately check how editorial drafts are handled: the risk is not just an incorrect response, but also the possibility of visitors seeing unpublished content.

Site owners and marketers should distinguish between the consequences. In one case, a visitor may see content from another route; in another, they may receive a draft. The next dev issue affects the development environment, not the published site. The question for the team is which of these features the project uses and whether the dependency has been updated.

My take

I wouldn't take this release as a general sign that Next.js is unreliable. The scenarios described have different conditions: self-hosting and the Pages Router, the use of Draft Mode, or running next dev. In my view, a small team would benefit from a simple map of the project: where pages are generated, what is cached, and where images are loaded from.

I wouldn't put off the update just because some of the issues seem inapplicable. Install the patched version for your branch first, then check the settings and affected scenarios. That order seems simpler to me than investigating the configuration after a problem has already surfaced.

Sources

Where the news comes from. The text is a retelling in the author’s own words; the facts come from the source, the opinion is the author’s.

1. September 2026 Security Release nextjs.org

About the author

Pavel Novák

Experienced full-stack developer

I build web services for small companies in Brno. At the start, I try to choose a stack the team can comfortably maintain a couple of years down the road.

All posts by the author