TL;DR
- Next.js released v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) to address one high-severity and six medium-to-low vulnerabilities discovered in the framework.
- A high-severity Server-Side Request Forgery vulnerability in Image Optimization can be exploited through allow-listed remote URLs to access private IP ranges.
- Cache poisoning vulnerabilities affect self-hosted and Pages Router applications, enabling attackers to inject wrong content or draft-mode data into cached pages.
- The development server's Model Context Protocol endpoint exposes sensitive project information to malicious websites visited by developers.
- Active LTS Version
- v16.3.8
- Maintenance LTS
- v15.5.27
- Total Vulnerabilities
- 1 high, 6 medium/low
What happened
Next.js released security patches on September 30, 2026, addressing seven vulnerabilities across Active and Maintenance LTS branches. Updates are available in v16.3.8 for Active LTS and v15.5.27 for Maintenance LTS. The release was initially delayed due to upstream dependency issues but is now ready for immediate deployment.
npm install next@15.5.27 # for 15.5
npm install next@16.3.8 # for 16.3What changed
The high-severity vulnerability (CVE-2026-94483) involves Server-Side Request Forgery in Image Optimization. An attacker who controls an allow-listed remote URL can trigger requests to private IP ranges during Image Optimization, potentially accessing sensitive internal services. Applications without configured images.remotePatterns are not affected.
Multiple cache poisoning vulnerabilities affect both Pages Router and App Router deployments. In Pages Router applications using statically generated (SSG) or incrementally regenerated (ISR) pages, a cache entry can be replaced with content from a different route, serving incorrect content to all visitors until revalidation. Self-hosted deployments are at risk, while Vercel-hosted applications are unaffected. A root-level catch-all page combined with SSG or ISR routes creates a separate attack vector where an unauthenticated request can poison the shared response cache.
The App Router's metadata image routes (opengraph-image, twitter-image) built with webpack ignore the dynamicParams route segment option, allowing attackers to request URLs for dynamic segments excluded from generateStaticParams(). Turbopack-built applications are not affected. Cache Components can leak content across root parameter values when nested 'use cache' functions read root parameters, causing incorrect content for different parameter values. Additionally, pending cache fills can expose Draft Mode content to regular requests without authentication, and if those requests prerender pages, unpublished content persists for all subsequent visitors.
A low-severity vulnerability affects the development server's Model Context Protocol endpoint, which lacks origin verification. Malicious websites visited by developers can extract sensitive data including project file paths, source code snippets from error reports, route inventory, and development logs. Only applications run with `next dev` are affected; production deployments do not expose this endpoint.
Who it affects
All Next.js applications benefit from patching, but certain features increase risk. Applications using Image Optimization with configured remotePatterns need immediate updates. Pages Router applications with SSG or ISR pages face cache poisoning risks, particularly on self-hosted infrastructure. App Router deployments using metadata image routes with webpack and root-level catch-all pages should prioritize updates. Sites with Cache Components enabled that serve Draft Mode previews are vulnerable to content leakage.
What to do
Upgrade Next.js dependencies immediately to v16.3.8 or v15.5.27 depending on your LTS track. If you configure images.remotePatterns, review and restrict remote URLs to trusted sources only. Verify that self-hosted Pages Router applications have sufficient cache invalidation or implement request origin validation. For App Router applications using metadata image routes, ensure generateStaticParams() explicitly lists all allowed dynamic segments. If using Cache Components with Draft Mode, test that draft content is not leaked to regular requests after the patch.
Why it matters
These vulnerabilities cover multiple attack surfaces: network access (SSRF), content integrity (cache poisoning), information disclosure, and authentication bypass (Draft Mode leakage). Cache poisoning is particularly severe because it affects not just a single user but all visitors to a compromised page until revalidation. The SSRF vulnerability in Image Optimization is high-severity because it can access internal resources that would normally be restricted.
Source
Next.js Bloghttps://nextjs.org/blog/september-2026-security-releaseAI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.
- #next.js
- #security
- #vulnerabilities
- #cache
- #ssrf
