• Next.js application uses the App Router.
• Application defines at least one Server Action.
• Application is running a version of Next.js affected by this advisory (not yet upgraded to a patched release).

Affected

next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

16.4.1 · 15.5.28

ID

GHSA-p3m5-59mp-jv5r

Source summary

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version fo sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected

next >=10.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

16.4.1 · 15.5.28

ID

GHSA-2464-fhr4-w9xw

Source summary

Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.

Affected

in the source

Fixed in

none found

ID

WATCH-next-upcoming-nextjs-security-update-october-2026

• Next.js Image Optimization is in use.
• images.remotePatterns is configured with at least one allow-listed remote host.
• An allow-listed remote host's URL or DNS entries can be controlled by an attacker (e.g. resolving to private IPs).

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-cjq9-62q9-8jv4

• Next.js App Router application.
• Application is built with webpack.
• Uses metadata image routes such as opengraph-image or twitter-image within dynamic segments.
• Route segment sets dynamicParams to restrict params to those returned by generateStaticParams().

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-f87g-xv8r-7p7x

Source summary

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page: for example an on-demand prerender of a route that was not prerendered at build time: the…

Affected

next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-3w37-wq28-93x7

• Cache Components enabled (cacheComponents: true).
• A 'use cache' function calls another 'use cache' function.
• The inner 'use cache' function reads a root param.
• Content differs across root param values, so serving one value's cached entry for another leaks content.

Affected

next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-h694-7cp9-m8p3