Next.js Critical Flaws: Update to 16.4.1 or 15.5.28

On October 14, 2026, Next.js shipped versions 16.4.1 and 15.5.28 to fix two critical flaws that let an attacker run code on the server without logging in, plus a third that can take an app down. Depending on version and setup, it affects websites and stores built on Next.js that haven't updated.

What we know

  • The release: per the official Next.js blog, this is an out-of-band security update. It includes two fixes postponed from the September release because of upstream dependency delays.
  • Flaw 1, critical (GHSA-673q-mjm6-r5xr): hits apps using App Router with Cache Components when a `use cache` function returns several typed arrays. The GitHub advisory rates it 9.5 (CVSS 4) and limits it to 16.0.0 through 16.4.0. There is no workaround: Next.js says to upgrade "immediately" even if your app has no such function.
  • Flaw 2, critical (CVE-2026-96889): sits in an upstream library used by Image Optimization and is triggered by SVG files when Next.js runs on glibc-based Linux. Also 9.5. The GitHub advisory lists 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
  • Flaw 3, high (GHSA-p3m5-59mp-jv5r): crafted requests can spike CPU and block the app. Only apps using App Router with at least one Server Action are affected, from 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Rated 8.2.
  • What to install: 16.4.1 on the 16 line, 15.5.28 on the 15 line.
  • Exploitation: according to The Hacker News, no attacks were known as of October 15.

What changes and what doesn't

What changes is the urgency: two unauthenticated critical flaws in a framework widely used for sites and stores. Next.js asks everyone to upgrade immediately.

Sites built on WordPress, Drupal or other CMSs are not affected, and neither are Pages Router apps for flaw 3. The advisories only list fixed versions on the 15.5 and 16.4 lines: anyone on an older line has to move up.

How to tell if it affects you

  1. Check the version. In the project folder, run `npm ls next` and `npm ls sharp`. If Next.js is between 10.0.0 and 15.5.27, or between 16.0.0 and 16.4.0, at least one of the three may apply, depending on your setup.
  2. Update on your line. `npm install next@16.4.1` or `npm install next@15.5.28`, then redeploy. Run `npm ls sharp` again: it should be 0.35.5 or later.
  3. If you can't update today, only the SVG flaw has a stopgap: force sharp 0.35.5 or later. The other two have no alternative to upgrading.
  4. If you host on Vercel, Netlify or similar, the update happens in your code: the platform doesn't change your Next.js version for you.
  5. If someone else maintains the site, ask them today which Next.js version it runs and when they will update it.

Related: Web Design and Development

Sources

Updates: if attacks using these flaws appear or Next.js ships a newer release, it will be added here with a link.