Blog
2 min read

Next.js September 2026 Security Release: Upgrade to 16.3.8 or 15.5.27

Next.js patched seven vulnerabilities on 30 September 2026 in v16.3.8 and v15.5.27, after an out-of-band critical fix on 22 September. A high-severity SSRF in image optimisation, several cache-poisoning and cache-leak issues for SSG/ISR and 'use cache', and a dev-server MCP endpoint that leaked project data to malicious websites. Who's affected and what to do.

Next.js released security patches on 30 September 2026: v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS). This followed an out-of-band release on 22 September (16.3.6 / 15.5.26) for a critical issue in an upstream dependency. If you self-host Next.js, update.

npm install next@16.3.8   # 16.x apps (or upgrade to 16.4)
npm install next@15.5.27  # 15.5 apps

What was fixed

High — SSRF in Image Optimization (CVE-2026-94483). An attacker-controlled URL on an allow-listed remote host could make the image optimiser fetch internal addresses. Not affected if you have no images.remotePatterns. (SSRF Explained)

Medium — cache poisoning in self-hosted Pages Router apps (CVE-2026-94543). SSG/ISR pages could have their cache entry replaced with another route's content, serving wrong content to everyone until revalidation. Vercel-hosted apps aren't affected.

Medium — shared response cache poisoning (CVE-2026-94484). Apps with a root-level catch-all page plus SSG/ISR routes could have their cache poisoned by a single crafted, unauthenticated request — content substitution and persistent denial of service.

Medium — metadata image routes ignore dynamicParams (CVE-2026-94485). Webpack-built App Router apps could render opengraph-image/twitter-image for params you'd excluded. Turbopack builds aren't affected.

Medium — nested 'use cache' keyed incorrectly with root params, so content for one root param value could be served for another (not attacker-controllable). (Next.js Cache Components)

Medium — Draft Mode content leaking via pending use cache fills (CVE-2026-94544), potentially persisting unpublished content into prerendered pages.

Low — the dev server's MCP endpoint (CVE-2026-94486) didn't check request origin, so a malicious website you visited while running next dev could read your project's location on disk, source snippets from error reports, routes and dev logs. Production isn't affected — but it's a reminder that local dev servers are reachable from your browser. (DNS Rebinding, Secure MCP Servers)

Who needs to act

  • Self-hosted Next.js (VPS, Docker, your own platform): update now. Several issues specifically affect self-hosting. (Self-Hosting Next.js Without Vercel)
  • On Vercel: some issues don't apply, but update anyway — the dev-server and SSRF issues are framework-level.
  • Using images.remotePatterns, ISR, catch-all routes, Draft Mode or Cache Components: prioritise it.

Make this routine

Next.js 16.4's experimental.agentUpgrade defaults to nudging you about security upgrades during next dev and next build. Turn on Dependabot or Renovate too, so patch releases arrive as pull requests. (Next.js 16.4, Dependabot Explained)

Source: Next.js September 2026 Security Release

EasySpawn self-hosts Next.js apps on your own server, and Claude Code can apply security releases on a branch, run your tests and hand you a pull request. See how it works or join the waitlist.

Related: npm audit Explained · Update Dependencies Safely · OWASP Top 10 Explained · What Is Next.js?

Keep reading