Next.js patches seven security flaws in versions 16.4.5 and 15.5.29

What Next.js fixed on 3 November

On 3 November 2026, the Next.js team published a security release on the Next.js blog, after giving advance notice the week before. It fixes seven vulnerabilities: one rated high severity and six rated medium. The fixes are in version 16.4.5, the Active LTS (long-term support) line, and 15.5.29, the Maintenance LTS line. The team asks everyone using Next.js to update.

Four of the issues, including the high-severity one, involve Next.js’s caching feature, Cache Components, which stores pages and data so they can be reused:

• in three of them, content prepared for one tenant, site, locale or user could be served to another;
• in the fourth, on self-hosted sites, a crafted web address could make shared pages show the wrong content or keep returning “page not found” errors.

The other three concern a particular reverse-proxy set-up on self-hosted sites that could send one visitor’s response to another, Edge routes where cookie values meant to be hidden from scripts could be read by JavaScript on the same site, and image optimisation, where a disguised SVG file could get past a setting meant to block SVGs.

Which sites and apps are exposed

This affects you if your website, online store, customer portal or web application is built on Next.js. The greatest risk is for systems that serve several clients, brands, sites or languages from one application and use Cache Components. There, a leak could show one customer’s data to another, which is a confidentiality and data protection problem as well as a technical one.

Most of the issues only apply under specific conditions: Cache Components switched on, self-hosting rather than a managed platform, Edge routes setting cookies in a particular way, or an image backend able to decode SVG files. The source also limits some of them. The cookie issue needs an attacker’s script already running on your site, and the image issue does not, on its own, let an attacker run code.

If your software does not use Next.js, none of this applies to you.

What to ask your developers now

The source sets no deadline, but security fixes like these are best applied promptly. Ask whoever maintains your site or app to:

• confirm whether it uses Next.js, and which version;
• update to 16.4.5 or 15.5.29, depending on the line you are on;
• if you are on an older version, explain the upgrade path, since the release names only these two lines;
• check whether you use Cache Components, self-hosting, Edge routes or image optimisation, as these decide how urgent the update is;
• test key pages and logins after updating, and clear cached content if there is any doubt it was served to the wrong people.

If you have no one looking after your software, Cognivise’s ongoing support and ownership service covers updates like this one.