Next.js security releases in 2026: which version fixes what

As of October 24, 2026, 06:35 JST (October 23, 21:35 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9), on October 24 unless it says otherwise. This page is a running list: each new Next.js security release adds a row to the tables below and a line to Updates to this page.

Install Next.js 16.4.3 on 16.x, or 15.5.28 with sharp 0.35.5 or later on 15.x: those carry the October 14, 2026 security update, which fixed two Critical remote code execution bugs and a High denial of service. Older 16.x and 15.x minors and 14.x get no fix.

As npm showed at 05:36 JST, 16.4.3 and 15.5.28 are the newest releases of the two lines Next.js supports. On 15.x, check sharp too: 15.5.28 still accepts the 0.34.x your lockfile may hold, and the SVG fix needs 0.35.5 or later (the sharp check). The two Critical bugs are GHSA-673q-mjm6-r5xr, in use cache functions, and GHSA-2464-fhr4-w9xw (CVE-2026-96889), in image optimization of SVG files; the High one is GHSA-p3m5-59mp-jv5r, in Server Actions. 16.4.2 (October 15) and 16.4.3 (October 23) are bug-fix releases whose notes name no advisory, so 16.4.1 is the lowest 16.x version with every 2026 fix. No 16.3.x, 16.2.x, or 15.4.x release has the October fixes, and 14.x and older get none: move those apps to 16.4.3, or to 15.5.28 with sharp 0.35.5 or later.

Below: the version to install for each release line, all 10 security releases of 2026 and their 44 advisories, an "am I affected" check for each October 14 advisory, what each hosting platform has said, the update steps for npm, pnpm, yarn, and bun, and how Next.js announces the next release.

Which version to install now

The line statuses are from Next.js's support policy (checked 05:40). It says Active LTS gets "new features, regular bug fixes, performance improvements, and security patches", and Maintenance LTS "only critical bug fixes and essential security updates". The same page says "Each major version will remain in Maintenance LTS for two years following the initial release." It gives 15.x's release date as October 21, 2024, so if the two years count from that day, they ended on October 21, 2026. The page still lists 15.x as Maintenance LTS and gives no end date. OpenNext, which runs Next.js on Cloudflare and AWS, reads it differently: its release notes of October 21 say "A major version stays supported until the second next major (Next.js 17) is released". Next.js hasn't said which reading is right. This page's advice, not Next.js's: if you're on 15.x, plan the move to 16.x before the next security release rather than after it.

npm's tags match the table: npm install next@latest installs 16.4.3 and npm install next@backport installs 15.5.28 (checked 05:36). The next-14 tag still points at 14.2.35, which has none of the 2026 fixes.

Every 2026 Next.js security release

By the advisories Next.js has published in its GitHub repository (checked 05:37), 10 releases in 2026 carried security fixes, with 44 advisories between them. Until July, each came as an ad hoc patch; in Next.js's words, these "came with no advance notice and caused disruption for our users". On July 13 Next.js moved to scheduled releases: "roughly once a month" it posts a notice of the next one on its blog, and it keeps out-of-band updates for urgent fixes.

The dates are when the fixed versions reached npm and the advisories were published. Next.js's post for the July release is dated July 20, and the release itself went out on July 21; a note on the July 13 post says the date moved from July 20 to July 21. January 26 is the last time Next.js published fixes for 15.0 to 15.4 and for 16.0.

Every advisory, newest first

Severity and score are GitHub's records of each advisory: CVSS 4.0 where Next.js gave one, CVSS 3.1 otherwise (checked 05:37). The titles are Next.js's.

Four notes on the IDs, each from the record named (checked 05:37–05:43):

• CVE-2026-96889 is librsvg's CVE, not a Next.js one. Red Hat, as the CVE Numbering Authority, published it at CVE.org on September 23 as "Librsvg: use-after-free when xml includes have duplicated entities", with a CVSS 3.1 score of 7.8. Next.js's advisory GHSA-2464-fhr4-w9xw names it and rates the Next.js case Critical, 9.5 in CVSS 4.0.
• GHSA-p3m5-59mp-jv5r got a CVE after the release. Next.js's post names none; GitHub published CVE-2026-94482 for it at CVE.org on October 22 at 15:22 UTC. GHSA-673q-mjm6-r5xr and GHSA-2xp9-vwfh-vxw4 have no CVE ID in GitHub's records.
• Five advisories point to an upstream one: GHSA-673q-mjm6-r5xr to React's GHSA-xqc2-xf4c-x3h3, GHSA-p3m5-59mp-jv5r to React's GHSA-h3gv-c5rc-p453, GHSA-vcvr-r3jv-pc5j to Satori's GHSA-wx4j-mvgx-mqwp, and GHSA-2xp9-vwfh-vxw4 to libheif's GHSA-g89c-p67h-r497, per the Next.js posts; GHSA-2464-fhr4-w9xw names CVE-2026-96889.
• Next.js's repository advisories of September 30 show the fixed version as 16.3.? and 15.5.? for six of the seven; GitHub's global record of GHSA-cjq9-62q9-8jv4 says 16.3.8. The table takes 16.3.8 and 15.5.27 from Next.js's own post, and the 15.x column only where GitHub lists 15.x as affected.

The October 14 update: are you affected?

Each "affected" cell is in the advisory's own words or version ranges; the ranges are from GitHub's advisory database (checked 05:39).

To check your app in two minutes, run these in the project's root:

• Versions: npm ls next sharp. You need next 16.4.1 or later on 16.x, or 15.5.28 on 15.x, and sharp 0.35.5 or later.
• Cache Components: grep -rn "cacheComponents\|useCache" next.config.* and grep -rln "use cache" app src. Any hit means the use cache advisory can apply.
• Server Actions: grep -rln "use server" app src. Any hit in an App Router app means the denial of service applies.
• glibc or not: node -p "process.report.getReport().header.glibcVersionRuntime" on the server or inside the image. A version number means glibc; undefined means another C library, such as musl on Alpine. The SVG advisory names glibc-based Linux and says nothing about musl.

The sharp check on 15.5.28

sharp is an optional dependency of Next.js, and the two fixed versions ask for it differently (npm, checked 05:39). next@16.4.1 asks for ^0.35.5, so it can't be installed with an older sharp. next@15.5.28 accepts ^0.34.3 || ^0.35.5, so a lockfile that already holds a 0.34.x sharp keeps it. next@15.4.11 asks for ^0.34.3 (checked 06:40), so every 15.4.x lockfile holds 0.34.x, and moving it to 15.5.28 keeps that. That range is 15.5.28's whole change for the SVG bug: between 15.5.27 and 15.5.28, the one image change on GitHub is "[next/image] Bump sharp" (checked 06:35). A 15.x project created before sharp 0.35.0 came out on June 10 most likely holds 0.34.x.

This page's own test, with npm 10.9.9 at 05:45: a lockfile with next 15.5.27 and sharp 0.34.5, after npm install next@15.5.28, still held sharp 0.34.5. npm audit then reported sharp as High, through GHSA-wq5f-xc86-pv6w, "sharp : Vulnerability in librsvg dependency CVE-2026-96889", fixed in 0.35.5. npm update sharp moved it to 0.35.5. A fresh install takes 0.35.5, npm's latest for sharp since September 27.

The same test on a fresh next 15.5.28 project left one more npm audit finding: postcss 8.4.31, which next 15.5.28 pins, with four advisories, two of them High. npm's suggested fix is next 16.4.3, which it marks as a major version change. On 16.4.3, npm audit reported nothing (05:40).

What each hosting platform has said

This table holds only what each platform says on its own pages. It is the part of this page that goes stale first.

A self-hosted Next.js that optimizes images also needs the Node.js release of October 21: Vercel says "Next.js does not block Brotli responses in image optimization", and Node.js October 2026 security release: what to update has the fixed Node.js versions and the steps.

Update Next.js and check what you run

1. Find the versions you run

Run npm ls next sharp in the project. With pnpm, run pnpm why next and pnpm why sharp; with yarn, yarn why next; with bun, bun pm ls --all. npx next info also prints the Next.js version along with your platform. For a deployed app, read the lockfile of the commit that is live, not your working copy.

2. Install the fixed version

On 16.x, run npm install next@16.4.3, pnpm add next@16.4.3, yarn add next@16.4.3, or bun add next@16.4.3. On 15.x, use next@15.5.28 in the same commands. If package.json lists eslint-config-next or other @next/ packages, move them to the same version.

3. Check sharp

Run npm ls sharp again. Below 0.35.5: if sharp is listed in your package.json, run npm install sharp@^0.35.5 (or pnpm add, yarn add, bun add with the same version). Otherwise run npm update sharp (pnpm update sharp, yarn up -R sharp on Yarn 2 and later, or bun update sharp). Then check once more.

4. Run the audit

Run npm audit, pnpm audit, or yarn npm audit on Yarn 2 and later. On 16.4.3 it should report no advisory against next; on 15.5.28 it still reports postcss, as described in the sharp check. GitHub's advisory database, where the audit's links point, published its records of the three October 14 advisories on October 22, between 15:50 and 16:42 UTC, eight days after the release (checked 05:39). A scan that reads this database had no record of them before then.

5. Rebuild, redeploy, and restart

Commit the lockfile and deploy from it. Rebuild Docker images so they install the new lockfile, then restart every process that runs next start or your custom server. On Netlify and other hosts that keep old preview deploys online, delete the previews built before the update.

6. Move off the lines with no fix

16.0 to 16.3 get the October fixes only by moving to 16.4.1 or later. 15.0 to 15.4, 14.x, and older get them only by moving to 16.4.3, or to 15.5.28 with sharp 0.35.5 or later.

How Next.js announces the next release

Since July, every release came with a notice on the Next.js blog first; only the out-of-band one of September 22 had its notice the same day (checked 05:37):

Next.js says each notice will give "the expected release timeline and the highest anticipated severity", and that "for urgent disclosures that cannot wait, or vulnerabilities that are already being exploited in the wild", it will still publish ad-hoc patches. The other four notices came 5 to 8 days before the release. The five releases since July reached npm on a Tuesday or Wednesday between 15:32 and 17:43 UTC, which is 00:32 to 02:43 JST the next day.

As of 06:36 JST on October 24, the blog lists no notice for a next release. When one appears, this page gets an update the same day.

Tell your users what you patched

While you update and redeploy, the people who use your app may ask whether they need to do anything. Ask your coding agent for one HTML file, with no build step, that says you moved to a fixed Next.js release, when you redeployed, and what users should do, if anything.

Convika turns that file into a link: sign up free, drop the file on the upload screen, check the private preview, and publish. The page runs on Convika, apart from your app, so it stays up while you redeploy. On the free plan the page is public: search engines and Convika's gallery may list it, so leave out exact versions, hostnames, IP addresses, and anything internal.

Publish my update page

If what you built is only a page

Some things built with Next.js are a single marketing or notice page with a form, and no server code of their own. Published on Convika as one HTML file (ask your coding agent for a single static HTML file with no build step), such a page is HTML that Convika serves at a convika.page address or your own domain, so there is no Next.js server of yours to update for these releases (publish an HTML page, add a form without a backend). An app that needs a server, a database, or a login still needs the steps above.

Updates to this page

• October 24, 2026, 06:35 JST: first version. Every release, advisory, host row, and npm fact was read between 05:36 and 06:35 JST.

This page changes when Next.js posts a notice or publishes a release, when Vercel, Cloudflare, OpenNext, or AWS says something about the October 14 advisories, when GHSA-673q-mjm6-r5xr gets a CVE, when Next.js gives 15.x an end date, and when anything about attacks in the wild is reported. The same week: Node.js October 2026 security release: what to update and PHP October 2026 security release: what to update.

Frequently asked questions

Which Next.js version should I use right now?

16.4.3, npm's latest since October 23, or 15.5.28 if you can't leave 15.x yet (checked 05:36 JST on October 24). Both have the fixes of the October 14, 2026 security update; on 15.5.28, only with sharp 0.35.5 or later. 16.4.1 is the lowest 16.x version that has them.

Is Next.js 16.4.3 a security release?

No. Its release notes, and those of 16.4.2, list bug fixes and name no advisory. The security fixes came in 16.4.1 on October 14, and 16.4.3 includes them.

Which versions are affected by GHSA-673q-mjm6-r5xr?

16.0.0 to 16.4.0, in apps that use the App Router with Cache Components and have a use cache function that returns multiple typed arrays. There is no workaround, and Next.js says to upgrade to 16.4.1 or later "even if your application does not have similar functions". GitHub doesn't list 15.x as affected.

Is CVE-2026-96889 a Next.js vulnerability?

It is librsvg's CVE, which Red Hat published on September 23, 2026 with a CVSS 3.1 score of 7.8. Next.js's advisory GHSA-2464-fhr4-w9xw names it: the bug reaches Next.js's image optimization "when Next.js runs on glibc-based Linux", and Next.js rates that Critical, 9.5 in CVSS 4.0. The fix is sharp 0.35.5 or later: next 16.4.1 requires it, while next 15.5.28 still accepts 0.34.x, so on 15.x check npm ls sharp.

Do I need to update Next.js if I deploy on Vercel?

Yes: Next.js tells every app to update, so update and redeploy. Vercel has published no statement on the October 14 advisories as of 05:42 JST on October 24. For the August release it wrote that apps on Vercel were "protected and require no customer action", but it hasn't said that this time.

Is Next.js 15 still supported?

Yes, as Maintenance LTS, per Next.js's support policy (checked 05:40 JST on October 24), and 15.5.28 got the October fixes, the SVG one only with sharp 0.35.5 or later. The policy keeps a major in Maintenance LTS "for two years following the initial release", and 15.x came out on October 21, 2024. Next.js hasn't posted an end date. Only 15.5 gets fixes: 15.0 to 15.4 have had none since January 26, 2026.

Is Next.js 14 affected?

Yes, by the SVG advisory, whose range starts at 10.0.0, and by the Server Actions one, whose range starts at 13.0.0. 14.x is unsupported, and its last release, 14.2.35, is from December 11, 2025. Move to 16.4.3, or to 15.5.28 with sharp 0.35.5 or later.

Does npm audit find these vulnerabilities?

Yes, since October 22, when GitHub's advisory database published its records of the three, eight days after the release. In this page's test at 05:40 JST on October 24, npm audit on next 16.4.0 listed all three, and on next 16.4.3 it listed nothing. It also flags a sharp older than 0.35.5.

Are these vulnerabilities being exploited?

No source this page checked reports attacks on these Next.js advisories. Cloudflare's emergency WAF rule of October 14 says it blocks "active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks", and names no framework or CVE. CISA's Known Exploited Vulnerabilities catalog, version 2026.10.23, lists no Next.js CVE from 2026; its one React Server Components entry is CVE-2025-55182 from December 2025 (checked 05:42 JST on October 24). Next.js's posts don't mention attacks in the wild.

When is the next Next.js security release?

Not announced as of 06:36 JST on October 24. Next.js posts a notice on its blog before each scheduled release, 5 to 8 days ahead so far, and says it posts such notices "roughly once a month". Out-of-band fixes can come with little or no notice.

I use React Server Components without Next.js. What do I update?

React's advisory GHSA-xqc2-xf4c-x3h3, the upstream one of GHSA-673q-mjm6-r5xr, lists react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, fixed in 19.0.9, 19.1.10, 19.2.9, and 19.3.1 (checked 05:43 JST on October 24).

Sources

Times are in JST (UTC+9), on October 24, 2026.

• npm registry: next, its dist-tags, publish times, and the dependencies of 16.4.0, 16.4.1, 15.5.27, and 15.5.28 (05:36, 05:39; 06:09, 06:36)
• Next.js blog index (05:37; 06:09, 06:36)
• Next.js: Next.js Security Release and Our Next Patch Release, July 13 (05:37)
• Next.js: July 2026 Security Release (05:37)
• Next.js: Upcoming Next.js August Security Release, Update: August Next.js Security Release, and August 2026 Security Release (05:37)
• Next.js: Upcoming Next.js Security Update for a Critical Upstream Issue and Next.js Security Update for a Critical Upstream Issue, September 22 (05:37)
• Next.js: Upcoming Next.js September Security Release and September 2026 Security Release (05:37)
• Next.js: Upcoming Next.js Security Update for Upstream Vulnerabilities, October 8, and Next.js Security Update for Upstream Vulnerabilities, October 14 (05:37)
• Next.js Support Policy (05:40)
• vercel/next.js security advisories, all 44 of 2026 (05:37), and GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, and GHSA-p3m5-59mp-jv5r (05:38)
• GitHub Advisory Database: the records of GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, and GHSA-cjq9-62q9-8jv4 (05:39), and of the sharp advisories GHSA-wq5f-xc86-pv6w, GHSA-rgj7-g3m4-5g8c, and GHSA-f88m-g3jw-g9cj (05:46)
• Next.js v16.4.1, v15.5.28, v16.4.2, and v16.4.3 release notes (05:38), and the v15.5.27...v15.5.28 comparison (06:35)
• CVE.org: CVE-2026-96889 and CVE-2026-94482 (05:43)
• React: GHSA-xqc2-xf4c-x3h3 (05:43)
• sharp v0.35.5 release notes and npm registry: sharp (05:39, 05:44)
• npm audit, npm 10.9.9, run by this page on lockfiles for next 16.4.0, 16.4.3, 15.5.27, and 15.5.28, and on one that held sharp 0.34.5 (05:40, 05:45)
• Netlify: Next.js & React security release (Oct 2026): what to know, dated October 14 (05:40; 06:09)
• Vercel changelog and its feed, Vercel Knowledge Base bulletins, and Vercel applications are protected from Next.js August 2026 security vulnerabilities (05:41–05:42; 06:09)
• Vercel: Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) (05:41)
• Cloudflare WAF changelog and WAF Release - 2026-10-14 - Emergency (05:41, 05:46)
• OpenNext Cloudflare adapter releases, 1.20.12 and 1.20.13, @opennextjs/aws v4.1.12, issue #1320, and OpenNext: Image optimization (05:42; 06:09, 06:34)
• AWS Amplify: Amplify support for Next.js and the AWS Security Bulletins feed (05:42)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.23 (05:42; 06:09)