---
title: "Next.js flaws in October 2026: which version should you upgrade to?"
description: "If your app is on Next.js 16, go to 16.4.1 or later. If it's on 15, go to 15.5.28 and make sure sharp is 0.35.5. Then build the project and redeploy it."
url: https://ihsanalapsi.dev/articles/nextjs-16-4-1-security-update
lang: en
date: 2026-10-21
updated: 2026-10-24
tags: ["Security updates", "Web development"]
author: Ihsan Alapsi (إحسان العبسي)
---
# Next.js flaws in October 2026: which version should you upgrade to?

On October 14, 2026, the Next.js team published an out-of-band security update for three vulnerabilities, two of them critical. If you have a Next.js app on Vercel, on Netlify or on your own server, by the end of this page you'll know which of them affect your app, you'll have upgraded and redeployed, and you'll have a plan to move from 15 to 16.

## Which Next.js version should you upgrade to now?

If your app is on Next.js 16, upgrade to 16.4.1 or later. If it's on Next.js 15, upgrade to 15.5.28. These are the first two versions with the fix.

This is how the command appears in [the Next.js team's announcement](https://nextjs.org/blog/nextjs-security-update-october-14-2026):

```bash
npm install next@15.5.28  # for 15.5
npm install next@16.4.1   # for 16.4
```

16.4.2 came out on October 15, and [its release notes](https://github.com/vercel/next.js/releases/tag/v16.4.2) list fixes mostly for Turbopack and the docs, with no new security fix. It's the `latest` version on npm as of October 21, 2026, and the advisories treat 16.4.0 as the last affected version, so 16.4.2 works too.


| Your version now | Go to            | What you need to know                                                                                                                     |
| ---------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| 16.0.0 to 16.4.0 | 16.4.1 or later  | All three vulnerabilities can affect you if their conditions apply (according to its advisory, the SVG one affects versions after 16.0.0) |
| 15.0 to 15.5.27  | 15.5.28          | The `use cache` vulnerability doesn't affect 15, the other two do. Check your sharp version (below)                                       |
| 14 or older      | 15.5.28 at least | There is no patched 14 release, and 14 is out of support                                                                                  |


As of October 21, 2026 there are no reports of exploitation in the wild: neither the announcement nor the advisories mention exploitation, [The Hacker News](https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html) wrote on October 15 that there were no public reports, and the vulnerability isn't in [CISA's catalog of exploited vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

But exploit code is public for the SVG image vulnerability. The researcher who found the flaw published [a write-up](https://github.com/rafabd1/VectorFreed) with proof-of-concept code, and wrote that they reached command execution through two paths in Next.js. And since October 16 there has been proof-of-concept exploit code on GitHub for the image optimization path, tested on 16.4.0 and 15.5.27 with sharp 0.35.4.

## What are the three vulnerabilities and who does each one affect?

Two of them are remote code execution (RCE) without sign-in: someone outside can run code on your server. The third is a denial of service (DoS) that keeps the CPU so busy that the process that received the request stops handling other requests. Each one has a condition it needs before it can affect your app.

Each vulnerability has a security advisory page on GitHub with a GHSA ID, a severity score on the CVSS 4.0 scale out of 10, and the affected versions in this format:


| Vulnerability                                                                                                                                               | Score         | Affected versions                            | Who it affects                             | Workaround?                |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | -------------------------------------------- | ------------------------------------------ | -------------------------- |
| Code execution in `use cache` functions ([GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr))                  | Critical, 9.5 | `>=16.0.0 <=16.4.0`                          | App Router with Cache Components           | No                         |
| Code execution in SVG image optimization ([GHSA-2464-fhr4-w9xw](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw), CVE-2026-96889) | Critical, 9.5 | `>=10.0.0 <=15.5.27` and `>16.0.0 <=16.4.0`  | Next.js running on glibc-based Linux       | Yes: sharp 0.35.5 or later |
| Denial of service in Server Actions ([GHSA-p3m5-59mp-jv5r](https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r))                      | High, 8.2     | `>=13.0.0 <=15.5.27` and `>=16.0.0 <=16.4.0` | App Router with at least one Server Action | No                         |


### The `use cache` vulnerability: Next.js 16 only

Cache Components is the caching model in Next.js 16: you mark a page, a component or a function with the `use cache` directive, and its result is stored. You turn it on with `cacheComponents: true` in `next.config` ([docs](https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheComponents)).

The vulnerability happens when a `use cache` function returns more than one typed array along with a value the attacker controls. A typed array is an array that exposes binary data, like `Uint8Array` ([MDN](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray)). The root of the flaw is in React, and [React's advisory](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3) describes the affected cases as very rare. There's no workaround, and the team says to upgrade even if you don't have a function like this.

### The SVG image vulnerability: Next.js 10 to 16

Next.js uses the sharp library to optimize images, and sharp reads SVG files with a library called librsvg. The flaw is in librsvg, and according to [sharp's advisory](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w) it can lead to code execution under certain runtime conditions, on glibc-based Linux. glibc is the core C library on GNU/Linux systems ([GNU](https://www.gnu.org/software/libc/)).

The workaround is to make sure the sharp that Next.js uses is 0.35.5 or later.

The default config doesn't protect you here. [The Image component docs](https://nextjs.org/docs/app/api-reference/components/image) say SVG images are only optimized with `dangerouslyAllowSVG: true`, but according to [the write-up by the researcher who found the flaw](https://github.com/rafabd1/VectorFreed), a specially crafted image gets past the SVG rejection in the Image Optimization API and reaches librsvg. The condition is that the optimizer accepts an image whose source the attacker controls, like a URL from a domain allowed in `remotePatterns` or a file a user uploaded.

There's a second path too: [Netlify's note](https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/) says `ImageResponse` from `next/og` reaches the same flaw when it renders user input.

### The Server Actions vulnerability: Next.js 13 to 16

A Server Action is an async function that runs on the server and that the front end calls with a network request, like the function you bind to the `action` of a `<form>` ([docs](https://nextjs.org/docs/app/getting-started/mutating-data)). Specially crafted requests to an App Router app with at least one of them push CPU usage up, so the same process stops handling other requests. Pages Router apps and apps without Server Actions aren't affected, and upgrading is the only fix.

## How do you find your version and the sharp version that is installed?

From the project folder, `npx next --version` gives you the Next.js version, and `npm ls sharp` gives you the sharp version installed in the package tree, not the number written in `package.json`.

1. Open the terminal in the project folder and run both commands ([next docs](https://nextjs.org/docs/app/api-reference/cli/next) and [npm ls docs](https://docs.npmjs.com/cli/v11/commands/npm-ls)). You get the Next.js version, and a tree with every installed sharp version and what pulled it in:

```bash
npx next --version
npm ls sharp
```

If your project uses pnpm, yarn or bun, run `pnpm why sharp`, `yarn why sharp` or `bun why sharp` instead of `npm ls sharp` ([pnpm](https://pnpm.io/cli/why), [yarn](https://yarnpkg.com/cli/why), [bun](https://bun.com/docs/pm/cli/why)).

2. Check whether Cache Components is on and whether you have Server Actions. If `cacheComponents: true` shows up, the `use cache` vulnerability may apply to you. If files with `use server` show up, you have Server Actions:

```bash
git grep -n "cacheComponents"
git grep -ln "use server"
```

3. Don't rely on `npm audit` this time. The command queries the npm advisory database ([docs](https://docs.npmjs.com/cli/v11/commands/npm-audit)), and as of October 21, 2026 that database returns no advisory for `next@16.4.0` or `next@15.5.27`. So it will only warn you if sharp is older than 0.35.5.

## How do you upgrade and deploy, in order?

Install the patched version, make sure sharp is 0.35.5 or later, build the project, and redeploy. The patched version only reaches the server with a new build and a new deploy.

1. Install the version with the command above. With pnpm, yarn or bun, use the same version number with their add command, like `pnpm add next@16.4.1` (all four commands are in [the upgrade guide for 16](https://nextjs.org/docs/app/guides/upgrading/version-16)).
2. Run `npm ls sharp` (or your package manager's `why` command) again. Version 16.4.1 requires `^0.35.5`, so the upgrade brings the patched sharp with it. But 15.5.28 accepts `^0.34.3 || ^0.35.5` ([npm registry](https://registry.npmjs.org/next/15.5.28)), so if your lockfile already has 0.34, it may stay as it is. And sharp's advisory treats any version older than 0.35.5 as affected.
3. If sharp still shows up older than 0.35.5, pin its version with your package manager. With npm: add the `overrides` key to your `package.json`, run `npm install`, then `npm ls sharp` to confirm ([overrides docs](https://docs.npmjs.com/cli/v11/configuring-npm/package-json)). This number stays fixed, so change it when a newer version comes out:

```json
{
  "overrides": {
    "sharp": "0.35.5"
  }
}
```

In yarn it's the same idea with a key called `resolutions` in `package.json` ([docs](https://yarnpkg.com/configuration/manifest#resolutions)). In pnpm the key is `overrides`, but it goes in the `pnpm-workspace.yaml` file ([docs](https://pnpm.io/settings/dependency-resolution#overrides)). And bun reads `overrides` from `package.json` like npm ([docs](https://bun.com/docs/pm/overrides)). After installing, confirm with your package manager's `why` command.

4. Build the project with `npm run build`, and test the pages with images and forms before you deploy.
5. Redeploy. On Netlify, preview deploys and branch deploys with public URLs can stay affected until they're deleted on their own, and the company recommends deleting them by hand. If your platform keeps old versions on public URLs, delete those too.

If you work with a coding agent, `npx next@canary upgrade --agent` with no policy (and no `experimental.agentUpgrade` in `next.config`) uses the `security` policy: if your stable version is affected, it picks the newest safe version on the oldest eligible major line. The command is still experimental ([docs](https://nextjs.org/docs/app/guides/upgrading/agent-upgrade)).

## What changes if your app is on Netlify, on Vercel or on your own server?

What changes with the host is the impact of the vulnerabilities on your app. On Netlify, according to its note, two of them have a lighter impact. Vercel hasn't published a platform note as of October 21, 2026. And on your own server, you carry the whole impact.

### Netlify

The company published its note on the day of the announcement. According to it, the `use cache` vulnerability affects apps that meet the condition, like anywhere else. Image optimization with `next/image` goes through Netlify Image CDN, not through your function, but `ImageResponse` runs inside the function. There, the impact stops at the function crashing, not code execution. And the Server Actions vulnerability has little impact there, because a request that eats the CPU in one function doesn't affect other requests, but exploiting it can raise your functions bill.

### Vercel

As of October 21, 2026, [Vercel's changelog](https://vercel.com/changelog) has no platform note about these vulnerabilities like Netlify's. So the instructions you have are the Next.js announcement itself: upgrade and redeploy.

### Your own server or Docker

The Server Actions vulnerability hangs the process that received the request, so if your whole site runs in a single Node.js process, the whole site stops.

The SVG vulnerability requires glibc, and Alpine is built on musl ([Alpine's site](https://www.alpinelinux.org/about/)), so if your Docker image is Alpine, the glibc condition in the advisory doesn't apply to you. But the flaw itself is in librsvg, the prebuilt sharp for musl includes librsvg too ([its library list](https://unpkg.com/@img/sharp-libvips-linuxmusl-x64@1.3.4/versions.json)), and the researcher who found the flaw wrote that a process crash is one of its outcomes. So upgrade like everyone else.

sharp's advisory adds that running a Node.js built with the PIE option prevents code execution, and that the official Node.js builds aren't built that way.

## Why should you plan the move from 15 to 16 now?

Because Next.js 15 is in Maintenance LTS, which means it only gets critical and security fixes, and the support policy says each major version stays in this phase for two years from its release. 15 came out on October 21, 2024.

[The support policy page](https://nextjs.org/support-policy) doesn't give an end date for 15. But if you count two years from October 21, 2024, you get to about October 21, 2026. That's a calculation from the policy text, not a date written in it. The policy also says the team may patch unsupported versions in rare cases, depending on how severe the flaw is.

The migration plan, following [the upgrade guide for 16](https://nextjs.org/docs/app/guides/upgrading/version-16):

1. Update Node.js to 20.9 or later, and TypeScript to 5.1 or later if you use it.
2. Run the official codemod from the project folder:

```bash
npx @next/codemod@canary upgrade latest
```

3. Review the breaking changes: `cookies()`, `headers()`, `params` and `searchParams` are now async only, the `middleware` file is now called `proxy` (unless your middleware runs on the edge runtime: the guide says to keep it as `middleware`), Turbopack is now the default for `next dev` and `next build`, and `next lint` was removed.
4. Build and test the important pages, then deploy.

Don't turn on Cache Components just because you upgraded: the guide itself says it doesn't need to be on to finish the upgrade. The guide also recommends a coding agent for the whole move: `npx next@canary upgrade --agent=latest` prepares the upgrade guides for the agent, asks it to apply them and verify the result, and can open a Claude Code or Codex session installed on your machine. Here too the command is experimental, so review the changes yourself before you deploy.

## Where do you start now?

Run `npx next --version` and `npm ls sharp` in your project. If Next.js is older than 16.4.1 or 15.5.28, or sharp is older than 0.35.5, upgrade, build and deploy today.

The upgrade closes the framework's vulnerabilities, but the vulnerabilities in your own code don't get fixed by a library update: a missing permission check, or a user who reaches someone else's data by changing a number in the URL. The [Security Skill Pack](/products/security-skill-pack) (coming soon) will review your project's code and flag vulnerabilities like these before you deploy, and you're the one who runs it.

The pack is listed in the [AI skills](/products/c/ai-skills) section, with the other skills ready for Claude Code and AI tools.

If you want someone to test your whole platform the way an attacker would, that's what [Muhassan](/muhassan) does.

Which version did you get?

## FAQ

**If my app only uses Pages Router, do I need to upgrade?**

Yes. The Server Actions vulnerability doesn't affect Pages Router, but the advisory for the SVG image vulnerability doesn't name a router, and it covers versions 10.0.0 to 15.5.27, and from after 16.0.0 to 16.4.0.

**I'm on Next.js 14. Is there a patched 14 release?**

No. The advisories name only 15.5.28 and 16.4.1 as patched versions, and the Next.js support policy lists 14 among the unsupported versions. The closest fix is to move to 15.5.28 with sharp 0.35.5, and then to 16. Note that the policy gives each major version two years from its release, and 15 came out on October 21, 2024, so its window ends around October 21, 2026. Don't put off the move to 16.

**Is 16.4.2 better than 16.4.1?**

Yes, if nothing stops you. 16.4.2 came out on October 15, 2026 with fixes mostly for Turbopack, and it comes after 16.4.0, the last affected version. The announcement came out on October 14, a day before 16.4.2, so it names 16.4.1, the first patched version.

**If I use React Server Components with a framework other than Next.js, what do I do?**

Upgrade the react-server-dom-webpack, react-server-dom-parcel or react-server-dom-turbopack packages to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, depending on the line you're on. That's what React's advisories for the two original vulnerabilities say.

**Does npm audit warn me about these vulnerabilities?**

Not about all of them. As of October 21, 2026, the npm advisory database returns no advisory for next on 16.4.0 or 15.5.27, so the command only warns you if sharp is older than 0.35.5. Rely on the version number you have.