• Next.js application uses the App Router.
• Application defines at least one Server Action.
• Next.js version is an unpatched (vulnerable) release.

Affected

next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-p3m5-59mp-jv5r

Source summary

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version of sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected

next >=10.0.0 <=15.5.27 · next >16.0.0 <=16.4.0 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-2464-fhr4-w9xw

Source summary

Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.

Affected

in the source

Fixed in

no fix yet

ID

WATCH-next-upcoming-nextjs-security-update-october-2026

Source summary

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-cjq9-62q9-8jv4

Source summary

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams() .

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-f87g-xv8r-7p7x

Source summary

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page: for example an on-demand prerender of a route that was not prerendered at build time: the unpubli

Affected

next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-3w37-wq28-93x7

Source summary

Impact With Cache Components enabled ( cacheComponents: true ), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value: whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute t

Affected

next 16.3.0 · next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-h694-7cp9-m8p3