Next.js 15.5.29 patches seven moderate security flaws

What happened

Next.js version 15.5.29 was released on November 3, 2026, containing security fixes for seven moderate-severity vulnerabilities. The release addresses issues discovered across multiple areas of the framework including response handling, image optimization, Edge runtime behavior, and caching mechanisms. Each vulnerability was assigned a GitHub Security Advisory identifier and published simultaneously on the release date.

The vulnerabilities

The first advisory (GHSA-pc58-hwjq-p385) affects self-hosted Next.js applications that forward fetched responses, allowing cross-client response injection and disclosure. A second issue (GHSA-rhh4-g77r-r9qj) involves cross-user cache disclosure and poisoning in Next.js use cache when binary arguments are used. The third advisory (GHSA-vvgp-ww4w-46vf) describes cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route parameters.

The image optimization system contains a vulnerability (GHSA-7qx7-33qx-rqx2) where SVG files can bypass rejection checks. Information disclosure across root parameters occurs when a 'use cache' function is called through unstable_cache() (GHSA-mfr8-8qww-v76h). Another cache issue (GHSA-vc7v-qv4w-wrv8) involves cache leaks across root parameter values in nested 'use cache' functions via delayed inner stream metadata. Finally, HttpOnly cookies can be exposed through internal response headers on Next.js Edge runtime routes (GHSA-f3mh-rxg3-f5g2).

Impact and affected deployments

Applications self-hosting Next.js and forwarding external fetched responses are vulnerable to response injection that could expose data across clients. Projects using Edge runtime routes may inadvertently expose sensitive HttpOnly cookies. Any application relying on the 'use cache' directive with binary arguments or nested cache functions could experience cache poisoning or data leaks across users or requests with different root parameters. Image optimization configurations processing SVG files might accept malicious SVG content that should have been rejected.

Technical details in the patch

The concurrent canary release v16.5.0-canary.39, published the same day, reveals the specific fixes applied. Strip internal middleware cookie headers from edge responses prevents HttpOnly exposure on Edge routes. Fix stale compressed framing for forwarded fetch responses addresses the response injection vulnerability. The use cache key fix corrects behavior when binary arguments are supplied. Shared shell poisoning is prevented by fixing how request-supplied placeholder parameters are handled. Image optimization gains a false-positive AVIF/HEIC detection fix alongside the SVG bypass closure. Cache leaks are sealed through fixes to unstable_cache cold fills across root parameters and outer use cache entry reuse across different root parameter values.

Recommended action

Users running Next.js 15.5.x should upgrade to version 15.5.29 immediately. For applications on other major versions, check the GitHub Security Advisory Database for Next.js to determine if your version is affected by any of these seven vulnerabilities and consult release notes for corresponding patches. The security advisories and detailed technical information are available on the Next.js security page and GitHub Advisory Database. Organizations deploying self-hosted Next.js instances with response forwarding or Edge runtime routes should prioritize this update.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.