Next.js and React Security Update: Who Needs to Patch

What was fixed on 14 October

The Next.js team published an out-of-band security update on 14 October 2026, with patched releases 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) [1]. Two of the fixes had been postponed from the September release because they depended on upstream libraries [1]. Both versions appeared on npm that day [8].

Everything in this section is taken from the official advisories. Severity scores are the CVSS v4 numbers the advisories publish.

GHSA-673q-mjm6-r5xr (critical, 9.5): unauthenticated remote code execution in App Router apps using Cache Components, when a use cache function returns multiple typed arrays. It affects Next.js 16.0.0 to 16.4.0 and is fixed in 16.4.1 [2].

GHSA-2464-fhr4-w9xw, CVE-2026-96889 (critical, 9.5): unauthenticated remote code execution through the Image Optimization API with SVG files, via an upstream image library, on glibc-based Linux. It affects Next.js 10.0.0 to 15.5.27 and 16.x up to 16.4.0, and is fixed in 15.5.28 and 16.4.1 [3].

GHSA-p3m5-59mp-jv5r (high, 8.2): a denial of service where crafted requests to App Router apps with at least one Server Action can pin the CPU and block other requests in the same process. It affects Next.js 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0, and is fixed in 15.5.28 and 16.4.1 [4].

A five-minute check for your app

Run npm ls next sharp in the project (or the pnpm or Yarn equivalent) and note the versions your lockfile actually resolves, not the range written in package.json. If next is below 15.5.28 on the 15 line, or below 16.4.1 on the 16 line, you are on an affected version for at least one advisory.

Then answer four questions. Do you use the App Router? Do you have any Server Actions, meaning any function marked use server? Have you enabled Cache Components and written use cache functions? Do you serve images through next/image with the built-in optimizer on your own Linux server or container, or generate images with next/og?

A Pages Router app with no Server Actions is not affected by the denial of service [4]. An app on Next.js 15 cannot hit the use cache bug, because that advisory only lists 16.x [2]. But the image bug reaches back to version 10 [3], and the Next.js team says to upgrade even if your app has no use cache functions like the ones described [2]. So the checklist tells you how urgent this is, not whether to patch.

Your host changes the risk, not the fix

The image advisory is scoped to Next.js running on glibc-based Linux [3]. That covers most Debian and Ubuntu based Docker images, which is how many teams self-host Next.js. Images built on Alpine use musl instead of glibc, so they fall outside the advisory's stated scope. We would still not treat that as a reason to wait, because the patched release is a small version bump and your next base-image change could quietly move you back into scope.

Managed platforms change where the code runs. Netlify, for example, says its own image CDN serves next/image there, so that route is not exercised on its platform, but the same flaw is reachable through next/og ImageResponse, which runs in your function [7]. Netlify also notes that the denial of service mostly turns into extra function cost on autoscaling infrastructure rather than downtime [7]. Read your own host's notice for the details, and upgrade anyway: every platform's advice ends in the same version numbers.

Three things the headlines skip

Old preview deployments are still running the old code. Patching main and redeploying production does nothing for the branch and pull request previews you shipped last month. Netlify explicitly warns that public deploy previews may stay vulnerable until they are deleted [7]. If your previews are public, delete the stale ones or put them behind authentication.

The image library is a transitive dependency. The workaround in the advisory is to make sure Next.js uses sharp 0.35.5 or later, and the Next.js team says upgrading to the patched versions makes package managers pull a fixed sharp automatically [3]. After upgrading, run npm ls sharp again and confirm the resolved version, especially in monorepos or projects with overrides and pinned resolutions, where an old copy can survive.

Plain React apps without a server are not part of this. The React side of the fixes covers the react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack packages, with fixes back-ported to 19.0.9, 19.1.10, 19.2.9 and 19.3.1 [5]. React's advisory states that if your React code does not use a server, or you don't use a framework or bundler that supports React Server Components, you are not affected [5]. A client-rendered or statically prerendered Vite app is in that group. Our own site, for instance, is React 19 with Vite and build-time prerendering and has no server components, so we checked and nothing changed for us.

Next.js 15 is about to leave maintenance

The Next.js support policy lists 15.x as Maintenance LTS, released on 21 October 2024, and says each major version stays in Maintenance LTS for two years after its initial release [6]. Read together, that puts the end of 15.x maintenance on 21 October 2026, six days after this update. That date is our reading of the published policy rather than a separate announcement.

Prediction, not fact: 15.5.28 may be one of the last routine security releases for the 15 line. The policy does say the team will, in rare circumstances, patch versions outside LTS depending on severity [6], so a future critical bug might still get a 15.x fix. Planning on that would be a gamble. If you are on 15, take 15.5.28 now and schedule the move to 16 for the coming weeks, not next quarter.

How to patch without breaking production

Upgrade with npm install next@16.4.1 on the 16 line or npm install next@15.5.28 on the 15 line, as the Next.js post shows [1]. If you manage the React Server Components packages directly, move them to the patched React versions listed above [5]. Commit the lockfile, let CI run, and deploy.

Then verify, because a green build only proves it compiled. Confirm the deployed build reports the new next version, check that image routes and any Server Actions still work, and remove or protect stale previews. If you run several Next.js apps, check each one: the work is small per app but easy to skip on the internal dashboard nobody has touched since spring.

If your stack choice is still open, our guide on whether MERN is still worth it in 2026 covers how much server-side machinery a product really needs, which is also how much you will need to patch.

Frequently asked questions

The short version

Upgrade to 16.4.1 or 15.5.28, confirm the resolved sharp version, redeploy, and clean up old previews. Use the checklist to decide whether this is a tonight job or a this-week job, not whether to do it. And if you are still on 15, start planning the move to 16 now.

If you would like a second pair of hands on an upgrade like this, our web and SaaS development services page explains what we take on.