Source summary

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Affected

next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-p3m5-59mp-jv5r

Source summary

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.

Affected

in the source

Fixed in

no fix yet

ID

WATCH-next-upcoming-nextjs-security-update-october-2026

Source summary

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-cjq9-62q9-8jv4

Source summary

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams() .

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-f87g-xv8r-7p7x

Source summary

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page: for example an on-demand prerender of a route that was not prerendered at build time: the unpubli

Affected

next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-3w37-wq28-93x7

Source summary

Impact With Cache Components enabled ( cacheComponents: true ), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value: whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute t

Affected

next 16.3.0 · next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-h694-7cp9-m8p3

Source summary

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Affected

next >=15.0.0 <15.5.27 · next >=16.0.0 <16.3.8

Fixed in

15.5.27 · 16.3.8

ID

GHSA-4jqv-mc3x-m676