Next.js Security Update: 7 Fixes, Upgrade Now

Updated: 4 November 2026

The Next.js security update released on 3 November 2026 fixes seven vulnerabilities, so any business whose website or web app is built with Next.js should ask its developer to upgrade to v16.4.5 or v15.5.29. The Next.js team rates one issue High and six Medium.

If your website was built by an agency or freelancer, you may not even know whether it uses Next.js. This guide explains what was fixed, who is really at risk and the few questions a business owner should ask this week.

What is the Next.js security update about?

Next.js is a popular framework for building websites and web apps. On 27 October 2026 the Next.js team announced a scheduled security release for Tuesday, 3 November 2026. That advance notice said it would address seven medium vulnerabilities. The official release post, published on 3 November, lists seven issues, one rated High and six rated Medium.

According to the release post, patches are available in v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS). The post asks developers to patch their Next.js dependencies. It does not list a workaround or a deadline.

Which problems were fixed?

Most of the seven issues involve caching, which is how a site stores a page or data so it loads faster. In simple words, the release post describes cases where one visitor's or one tenant's content could be shown to another, or where a shared cached page could be corrupted.

• Cross-tenant cache disclosure (High): in apps using Cache Components, a cached function called two different ways at the same time could return another request's result.
• Nested cache and binary argument issues (Medium): two further cache problems could disclose or poison content shared between users.
• Shared page shell poisoning (Medium): affects self-hosted apps running `next start` with specific settings, where a crafted URL can cause wrong content or persistent 404 errors.
• Response injection through compressed responses (Medium): affects self-hosted apps behind a specific kind of reverse proxy.
• Cookie value exposure in Edge routes (Medium): cookies set with `NextResponse.cookies.set()` in Edge routes could appear in an internal header readable by same-origin JavaScript.
• SVG rejection bypass in Image Optimization (Medium): an image from a permitted source could slip past the `images.dangerouslyAllowSVG: false` setting. The post says it does not demonstrate script execution.

Is my website affected?

Not every Next.js site is exposed to every issue. Many of the problems apply only when particular features are switched on, such as Cache Components, Edge routes or a self-hosted setup. The GitHub advisory for the cache disclosure issue (GHSA-mfr8-8qww-v76h, shown with CVE-2026-119790) rates it Moderate with a CVSS score of 6.3 and lists affected versions as 16.3.0 and later. It also says that avoiding the risky nesting of cached functions is a complete workaround for that one issue.

The release post does not give affected version ranges for all seven issues, so the safe approach is simple: if your site uses Next.js, upgrade to a patched version instead of trying to judge exposure yourself. A plain brochure website using few features may be at low risk, but only your developer can confirm that.

Treat the ratings as a guide, not a reason to wait. Sites that serve different content to different customers, such as booking portals, dashboards or multi-branch stores, have more to lose if cached content leaks between users than a simple brochure site does.

How do I upgrade Next.js?

Your developer upgrades the `next` package in the project and redeploys the site. The release post gives these commands for the two supported lines:

• For the 15.x line: `npm install next@15.5.29`
• For the 16.x line: `npm install next@16.4.5`
• Test the site on a staging copy first, especially login, forms, payments and image-heavy pages.
• Redeploy, then check that the live site shows the expected behaviour.

What should a business owner ask the developer?

You do not need to read the advisories yourself. A few direct questions are enough to get a clear answer, and asking them now is cheaper than finding out about a problem after a customer reports it.

• Does our website or app use Next.js, and which version is it on today?
• Do we use caching features, Edge routes or a self-hosted server that the advisories mention?
• When will the patched version go live, and who tests it?
• Who watches security notices for the other tools our site depends on?

Treat this as routine maintenance with a clear fix: find out whether your site runs Next.js, and have it moved to v16.4.5 or v15.5.29. Details and advice can change as more information is published, so check the official Next.js release post and advisories for the latest.

Frequently asked questions

Which Next.js version fixes the November 2026 vulnerabilities?

The Next.js release post says patches are available in v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS).

How many vulnerabilities did the Next.js security release fix?

The release post of 3 November 2026 lists seven issues, one rated High and six rated Medium. The earlier advance notice had described all seven as medium.

How do I know if my website uses Next.js?

Ask your developer or agency, or check the project's package list for the next package. The site's hosting or build setup will also show it.

Is there a workaround if I cannot upgrade today?

The release post lists no workarounds. For the one cache issue covered in its GitHub advisory, avoiding the risky nesting of cached functions is described as a complete workaround, but upgrading is the recommended fix.

Sources

• Next.js: November 2026 Security Release (nextjs.org)
• Next.js: Upcoming Next.js Security Release, November 2026 (nextjs.org)
• GitHub advisory GHSA-mfr8-8qww-v76h: information disclosure across root params in Next.js (github.com)

This article is based on the sources above and was current on 4 November 2026.

Need help turning this into results for your business? Talk to the Knight21 team or see our software, AI and digital marketing services.