Next.js security release November 2026: 16.4.5 closes 2 RCEs and 8 more

Summary. Next.js shipped two security releases in three weeks, and one upgrade now covers both. On 14 October 2026, versions 16.4.1 and 15.5.28 fixed two Critical unauthenticated remote code execution (RCE) flaws scored 9.5 on CVSS 4.0: GHSA-673q-mjm6-r5xr in use cache functions that return multiple typed arrays (16.0.0 to 16.4.0, no workaround, no CVE), and CVE-2026-96889, a librsvg memory bug reached through sharp on glibc Linux (10.0.0 to 15.5.27 and 16.0.0 to 16.4.0). The same release fixed a High Server Actions denial of service, CVE-2026-94482. On 3 November, 16.4.5 and 15.5.29 fixed seven more advisories, CVE-2026-119346 to CVE-2026-119351 and CVE-2026-119790: cache leaks across tenants and users, an HttpOnly cookie leak on Edge routes, an SVG filter bypass and a response mix-up behind some proxies. Move 16.x to 16.4.5 or later (16.4.6, a bug-fix release on 9 November, is npm's latest) and 15.x to 15.5.29, make sure sharp resolves to 0.35.5 or later, purge shared caches and redeploy previews. Next.js 15 gets security releases until 31 January 2027; 14 and older get none. None of these CVEs is in CISA's KEV catalogue, and on 11 November CVE.org had no records for the seven November IDs, so scanners may stay quiet.

About this article. For engineering leads, platform teams and security owners who run Next.js in production. We checked every version range, identifier and score against the Next.js blog and support policy, the GitHub advisories and Advisory Database, CVE records, CISA's KEV catalogue, the npm registry and hosting providers' notices on 11 November 2026. Advisories are edited after publication, so re-check before you close a ticket. This is general information, not legal advice; it contains no exploit detail, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What shipped, and when

Next.js moved to a formal security release programme on 13 July 2026, with roughly monthly scheduled releases announced in advance and ad hoc patches kept for urgent cases. Since then the scheduled releases have come with about a week's notice, and upstream dependencies have forced two out-of-band updates. Counting from August, there have been five security releases in ten weeks.

The Next.js security blog and the linked advisories give these releases:

Two patterns stand out. Three of the RCEs since August came through the image pipeline: libheif and librsvg inside sharp, and Satori's SVG output in next/og. And releases on a line are cumulative: 16.4.5 sits above every affected range from October, so a team that skipped October closes both waves with one upgrade on 16.x. The 15.x line needs one extra check, covered below.

For engineering managers, the practical conclusion is to give Next.js patching a monthly change window with a named owner, the way most teams treat operating system patches. A standing slot costs less than a scramble every three weeks.

The two critical RCEs from 14 October

The October release was announced on 8 October as an out-of-band fix for three vulnerabilities in upstream dependencies, two Critical and one High, two of them postponed from the September release while upstream maintainers coordinated. The advisories went live on 14 October.

GHSA-673q-mjm6-r5xr: use cache functions returning typed arrays

This affects App Router applications with Cache Components enabled, where a use cache function returns multiple typed arrays. The advisory lists 16.0.0 to 16.4.0 as affected and 16.4.1 as the fix, with a CVSS 4.0 score of 9.5; GitHub's reviewed database classes it as CWE-502, deserialisation of untrusted data. On 11 November both pages still showed no CVE for it. Next.js 15 is outside the affected range.

The flaw sits in React Server Components. React's related advisory, GHSA-xqc2-xf4c-x3h3, covers react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, with fixes in 19.0.9, 19.1.10, 19.2.9 and 19.3.1. It received CVE-2026-126187 on 10 November.

There is no workaround. The advisory tells teams to upgrade even if they have no such function, which is sensible: few teams can prove that no cached function returns typed arrays indirectly through nested data.

CVE-2026-96889 (GHSA-2464-fhr4-w9xw): SVG through the image optimiser

The second Critical issue is a memory-safety bug in librsvg, the SVG renderer bundled in sharp, which Next.js uses for image optimisation. The Next.js advisory says it can lead to RCE when Next.js runs on glibc-based Linux. Affected versions are 10.0.0 to 15.5.27 and 16.x up to 16.4.0; the fixes are 15.5.28 and 16.4.1, scored CVSS 4.0 9.5.

Red Hat, which published the CVE record on 23 September, describes a use-after-free triggered by nested XML inclusions and scores it 7.8 on CVSS 3.1, local and needing user interaction. The sharp advisory, GHSA-wq5f-xc86-pv6w, rates it High (CVSS 4.0 8.9) with CWE-416. Its fix is sharp 0.35.5, which ships librsvg 2.63.2, and it documents two interim controls: block SVG decoding in sharp, and run a Node.js binary built as a Position Independent Executable, noting that the official Node.js binaries are not built that way. The gap between the scores reflects different impact assumptions, not a disagreement about the defect.

Exposure depends on configuration. The Next.js image optimiser rejects SVG by default (dangerouslyAllowSVG: false), but Netlify confirmed a second path: next/og ImageResponse, which runs inside your function. Our defensive reading is to assume exposure wherever untrusted SVG content can reach sharp, by any route.

The version detail matters more than the score. On npm, next@16.4.5 declares sharp as an optional dependency at ^0.35.5, so a 16.x upgrade pulls the fixed library. next@15.5.29 accepts ^0.34.3 || ^0.35.5, so an existing lockfile can keep an affected 0.34.x build after you upgrade Next.js. Check it explicitly.

The high-severity denial of service in the same release

CVE-2026-94482 (GHSA-p3m5-59mp-jv5r) lets crafted requests drive one server process to excessive CPU in App Router applications with at least one Server Action, blocking other requests in that process. It affects 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0, scores 8.2 and has no workaround. Pages Router applications and applications without Server Actions are not affected.

Neither October RCE nor the denial of service appears in CISA's Known Exploited Vulnerabilities catalogue (version of 10 November 2026), and the Cloud Security Alliance found no public reports of in-the-wild exploitation when it reviewed the release on 16 October. The Hacker News reported that a working exploit for the September next/og flaw, built for one server setup, had been published.

The seven advisories fixed on 3 November

The November release was pre-announced on 27 October as seven medium vulnerabilities. The advisories, all published on 3 November and last updated on 6 November, list the following. GitHub's release notes confirm that 16.4.5 fixes all seven and 15.5.29 fixes the three that reach 15.x.

Four of the seven are cache bugs in Cache Components, and they map directly onto how multi-tenant SaaS products are built. Root params, the route parameters of the root layout, are a common place to hold a tenant slug or locale. When a cache key omits that root param, content generated for one tenant can be served to another until the entry is revalidated or evicted. For the nested-function leak, the advisory says an attacker cannot choose which values leak; the first invocation to write the entry decides. The binary-argument and shared-shell issues differ: a caller can push their own result, or a crafted URL's values, into an entry that other users receive. The shared-shell advisory adds that no markup or script can be injected and no data is disclosed, but a single request can leave a persistent 404. The scores stay moderate, but in a B2B product one tenant seeing another tenant's dashboard is a reportable incident however it happened.

The other three are narrower. The Edge cookie issue copies the serialised cookie into an internal x-middleware-set-cookie header that same-origin JavaScript can read, which defeats HttpOnly, but only matters if an attacker can already run script on your origin. The SVG bypass lets an image from an allowed source be misclassified as AVIF so it reaches an SVG decoder you disabled; the blog says it does not by itself show cross-site scripting or RCE. The response framing issue needs a specific reverse proxy behaviour and does not apply to every proxy configuration.

Severity labels disagree, and scanners lag

Expect friction with vulnerability management tooling this month, for three reasons.

The labels conflict. The 27 October notice promised seven medium issues. The 3 November post labels GHSA-mfr8 High. Its GitHub advisory says Moderate at CVSS 6.3, GitHub's release notes for 16.4.5 list all seven under Moderate, and Netlify lists it as Medium. If your risk register imports CVSS scores automatically, a cross-tenant leak lands as a Medium. For a multi-tenant product, override it to High and record why.

The CVE records do not exist yet. The seven November advisories carry CVE IDs, but on 11 November CVE.org returned no record for any of them. Tools that match on CVE feeds have nothing to match. The use cache RCE has no CVE on the Next.js advisory at all, and the sharp fix appears under two IDs: the librsvg record CVE-2026-96889 and a separate record for sharp itself, CVE-2026-114111.

The global database is behind. Dependabot alerts fire only on GitHub-reviewed advisories. GitHub's reviewed database added the October advisories on 22 October, eight days after the fix. On 11 November its newest next entries were still from 22 October, and direct lookups for the November seven returned nothing.

The defensive answer is to track Next.js by version number, not by scanner output, until the databases catch up: anything on 16.x below 16.4.5 or 15.x below 15.5.29 is unpatched.

Which release line are you on?

The Next.js support policy defines the window. A major stays in Active LTS until the next major ships, then moves to Maintenance LTS for critical and security fixes only. Maintenance LTS for Next.js 15 was due to end on 21 October 2026; the policy now extends security releases for 15 to 31 January 2027.

The policy allows the team to patch versions outside LTS in rare circumstances. It did not do so this time: npm's newest 14.x build is still 14.2.35 from December 2025, so Next.js 14 apps carry two issues with no supported fix. Also check the runtime underneath: next@16.4.5 requires Node.js 20.9 or later, and choosing a Node line with runway is its own decision, covered in our guide to the Node.js 22 end of life on 30 April 2027.

Hosting platforms: Vercel, Netlify and self-hosted

Vercel

Vercel's Knowledge Base lists October and November 2026 bulletins for the Node.js Brotli decoder RCE, CVE-2026-111497, PHP's php2shell pair and Better Auth, each saying Vercel WAF protections do not replace patching. On 11 November it had no bulletin for the 14 October or 3 November Next.js releases; its most recent Next.js-specific bulletins date from December 2025. Three November advisories (response framing, SVG bypass and the shared shell) are scoped to self-hosted deployments, but the October RCEs, the Edge cookie leak and the other three cache bugs are not. Upgrade and redeploy, and do not assume a platform rule covers you without a written statement from Vercel.

One platform-agnostic point: preview and branch deployments are separate builds. An old preview built on 16.4.0 keeps that code reachable at its URL until you delete it or put it behind deployment protection.

Netlify

Netlify published the clearest platform analysis. For October, it said the image optimiser path is not exercised on Netlify because Netlify Image CDN handles images, but next/og ImageResponse runs in your function and is affected, with impact limited to a crashed invocation. For November, it lists GHSA-7qx7, GHSA-mfr8 and GHSA-pc58 as not affecting Netlify and the other four as affecting matching apps. The HttpOnly cookie issue also hits cookies set in Next.js Middleware on Netlify, which only the OpenNext adapter @netlify/plugin-nextjs 5.16.6 fixes. A redeploy picks that up automatically unless you pinned the adapter version.

Self-hosted: next start, standalone output, Docker and Kubernetes

Self-hosting carries the full exposure: sharp runs in your container, the shared fallback shell lives in your cache, and your reverse proxy decides whether the framing issue is reachable. Our guide to self-hosting Next.js without Vercel covers the cache setup; four checks are specific to these releases.

1. Base image. The librsvg advisory names glibc-based Linux. A musl image may change whether the bug leads to code execution, but the defect is still there; upgrade regardless.

1. Cached layers. Rebuild images without the layer cache. A Dockerfile that copies an old node_modules layer can ship sharp 0.34.x under a new Next.js version.

1. Custom cache handlers. If you use a Redis or object-storage cache handler, poisoned or cross-tenant entries survive a redeploy. Purge them.

1. Proxy behaviour. Ask your platform team whether the proxy in front of Node.js queues pipelined HTTP/1.1 requests on a shared backend connection, which is the condition GHSA-pc58 names.

Upgrade plan

A defensive sequence that works for a single app or a monorepo:

            # 1. Inventory: what is actually installed, per app
npm ls next sharp            # pnpm: pnpm why next sharp

# 2. Upgrade on your release line
npm install next@16.4.5      # 16.x (16.4.6 or later is also fine)
npm install next@15.5.29     # 15.x

# 3. 15.x (and any pinned 16.x lockfile): force the fixed sharp
npm install sharp@^0.35.5

# 4. Clean install, build, and confirm the resolved versions
npm ci && npm run build
npm ls next sharp
          

Then work through the operational steps:

1. Inventory beyond the main app. Include internal tools, marketing sites, admin panels, preview apps and every container image tag still deployed.

1. Commit the lockfile and block merges that downgrade next or sharp.

1. Check React server packages if any service uses react-server-dom-* outside Next.js, against React's advisory.

1. Rebuild images from scratch and redeploy every environment, including staging.

1. Purge shared caches: the Next.js data cache, any custom cache handler store, and CDN entries for tenant-scoped or locale-scoped routes.

1. Delete or protect old previews built on vulnerable versions.

1. Review logs for unusual /_next/image requests carrying SVG content, image worker crashes and CPU spikes on Server Action routes. The Cloud Security Alliance suggests looking back to 23 September, when the librsvg flaw became public.

1. Book the next window. Subscribe to the Next.js blog and the repository's security advisories. On 11 November no December release date had been announced; scheduled releases have come with about a week's notice.

If you cannot deploy today

These controls reduce exposure while a release is blocked. None replaces the upgrade, and two issues have no workaround at all.

• SVG RCE: make sure sharp is 0.35.5 or later, or block SVG decoding by calling sharp.block() for the VipsForeignLoadSvg operation, as the sharp advisory documents. Keep dangerouslyAllowSVG off unless you need it, and narrow images.remotePatterns to hosts you control.

• use cache RCE and Server Actions DoS: no workaround. Rate limiting Server Action endpoints at the edge limits the DoS blast radius, not the RCE.

• GHSA-mfr8: stop calling a use cache function inside unstable_cache(). The advisory says avoiding that nesting is a complete workaround.

• GHSA-vvgp: the advisory names partialPrefetching: true in next.config as a workaround.

• GHSA-f3mh: set sensitive cookies from Node.js runtime handlers or through cookies().set(), which the blog says the reproduced leak did not affect, and keep a strict Content Security Policy.

• GHSA-rhh4 and GHSA-pc58 (our suggestions, not vendor workarounds): key shared cached functions on a string user or account ID rather than binary values, and build a new response with the headers you intend to send instead of returning a fetched upstream Response unchanged.

Multi-tenant SaaS and data protection

Many Indian and global SaaS products put the tenant in the first path segment, which makes it a root param. That is the shape the cache advisories describe. After patching and purging, ask three questions: did any tenant-scoped page or API response sit in a shared cache between the vulnerable deployment and the purge; did that content include personal data; and do your logs show which tenant received which response?

If the answer to the second question is yes, bring in your data protection officer and legal counsel to assess obligations under India's DPDP Act 2023, the GDPR or customer contracts. That assessment depends on facts only you have. Products sold into the EU face vulnerability handling as a regulatory duty too; our guide to the Cyber Resilience Act's December 2027 obligations covers that side.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development services team can run a Next.js patch window for you, from inventory and lockfile checks to cache purges and post-deploy log review. Talk to us at /contact-us/.

Last updated: 11 November 2026.

References

1. Next.js Security Update for Upstream Vulnerabilities, 14 October 2026 — Next.js blog (Vercel)

1. GHSA-673q-mjm6-r5xr: Unauthenticated Remote Code Execution in use cache functions returning typed arrays — vercel/next.js on GitHub

1. GHSA-2464-fhr4-w9xw: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (CVE-2026-96889) — vercel/next.js on GitHub

1. GHSA-p3m5-59mp-jv5r: Denial of Service in App Router using Server Actions — GitHub Advisory Database

1. November 2026 Security Release, 3 November 2026 — Next.js blog (Vercel)

1. Release v16.4.5 — vercel/next.js on GitHub

1. next package metadata, dist-tags and publish times — npm registry

1. Release v16.4.6 — vercel/next.js on GitHub

1. Support Policy — Next.js (Vercel)

1. Known Exploited Vulnerabilities Catalog, JSON feed, version 2026.11.10 — CISA

1. CVE Services record lookup for CVE-2026-119790 (no record exists) — CVE Program

1. Next.js Security Release and Our Next Patch Release, 13 July 2026 — Next.js blog (Vercel)

1. Security posts index — Next.js blog (Vercel)

1. August 2026 Security Release, 25 August 2026 — Next.js blog (Vercel)

1. Next.js Security Update for a Critical Upstream Issue, 22 September 2026 — Next.js blog (Vercel)

1. GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse — vercel/next.js on GitHub

1. September 2026 Security Release, 30 September 2026 — Next.js blog (Vercel)

1. Upcoming Next.js Security Update for Upstream Vulnerabilities, 8 October 2026 — Next.js blog (Vercel)

1. GHSA-673q-mjm6-r5xr, reviewed 22 October 2026 — GitHub Advisory Database

1. GHSA-xqc2-xf4c-x3h3: Unauthenticated Remote Code Execution in React Server Components — GitHub Advisory Database

1. CVE-2026-126187 record, published 10 November 2026 — CVE Program

1. CVE-2026-96889 record: librsvg use-after-free when XML includes have duplicated entities — CVE Program (CNA: Red Hat)

1. GHSA-wq5f-xc86-pv6w: sharp vulnerability in librsvg dependency — GitHub Advisory Database

1. CSA research note: Next.js out-of-band patch, critical RCE in use cache and librsvg, 16 October 2026 — Cloud Security Alliance

1. GHSA-7qx7-33qx-rqx2: SVG rejection bypass in Next.js image optimization (CVE-2026-119347) — vercel/next.js on GitHub

1. Security Update: Next.js and React vulnerabilities (October 2026), 14 October 2026 — Netlify changelog

1. next 16.4.5 package metadata — npm registry

1. next 15.5.29 package metadata — npm registry

1. CVE-2026-94482 record: Next.js denial of service in App Router using Server Actions — CVE Program

1. Next.js ships out-of-band patch for two critical RCE flaws, October 2026 — The Hacker News

1. Upcoming Next.js November Security Release, 27 October 2026 — Next.js blog (Vercel)

1. GHSA-mfr8-8qww-v76h: Information disclosure across root params when a use cache function is called through unstable_cache (CVE-2026-119790) — vercel/next.js on GitHub

1. GHSA-vc7v-qv4w-wrv8: Cache leak across root param values in nested use cache functions (CVE-2026-119351) — vercel/next.js on GitHub

1. GHSA-vvgp-ww4w-46vf: Cache poisoning of shared fallback shells in Cache Components (CVE-2026-119350) — vercel/next.js on GitHub

1. GHSA-rhh4-g77r-r9qj: Cross-user cache disclosure and poisoning with binary use cache arguments (CVE-2026-119349) — vercel/next.js on GitHub

1. GHSA-pc58-hwjq-p385: Cross-client response injection in self-hosted applications forwarding fetched responses (CVE-2026-119348) — vercel/next.js on GitHub

1. GHSA-f3mh-rxg3-f5g2: HttpOnly cookie exposure through internal response header on Edge runtime routes (CVE-2026-119346) — vercel/next.js on GitHub

1. Release v15.5.29 — vercel/next.js on GitHub

1. Security Update: Multiple vulnerabilities in Next.js (November 2026), 3 November 2026 — Netlify changelog

1. CVE-2026-114111 record: sharp before 0.35.5 RCE via librsvg dependency — CVE Program (CNA: VulnCheck)

1. About the GitHub Advisory Database — GitHub Docs

1. Global security advisories for the npm package next, sorted by publication date — GitHub REST API

1. Security Bulletins — Vercel Knowledge Base