Next.js security release on November 3, 2026: seven medium vulnerabilities, and the October 14 fixes to install first (16.4.1, 15.5.28)

What Next.js has said about November 3

The October 27 post says the November 3 release addresses seven medium vulnerabilities in Next.js and that the full advisories, with impact, affected versions and upgrade instructions, are published with it. It recommends upgrading to a patched version once the release is available. It names no versions yet, so a version number that claims to fix these before November 3 is a guess.

The October 14 fixes, by advisory

Next.js published 16.4.1 and 15.5.28 to npm on October 14, 2026, with two fixes that had been held back from the September security release for upstream dependency delays. The advisories on GitHub give these ranges:

GHSA-673q-mjm6-r5xr  critical  use cache, typed arrays   16.0.0 to 16.4.0                     fixed in 16.4.1
CVE-2026-96889       critical  Image Optimization, SVG  10.0.0 to 15.5.27, 16.0.0 to 16.4.0  fixed in 15.5.28, 16.4.1
  (GHSA-2464-fhr4-w9xw)                                                        or sharp 0.35.5+
GHSA-p3m5-59mp-jv5r  high      Server Actions DoS       13.0.0 to 15.5.27, 16.0.0 to 16.4.0  fixed in 15.5.28, 16.4.1

Which apps each one hits

The use cache bug needs the App Router with Cache Components, and Next.js says to upgrade even if no function in the app returns typed arrays; it lists no workaround. The image bug is in a library Image Optimization uses and can be exploited when Next.js runs on glibc-based Linux. The Server Actions bug needs the App Router and at least one Server Action; Pages Router apps and apps without Server Actions are not affected.

Check the version the app really runs

The version in package.json is a range; the lockfile decides what a build installs, on Vercel too. Ask the package manager which next is installed, and check sharp for the image workaround.

npm ls next sharp
# pnpm why next / yarn why next
npm install next@16.4.3   # 16.x
npm install next@15.5.28  # 15.x

Still on Next.js 15 or 14

Next.js's support policy lists 15.x as Maintenance LTS and says its security releases are extended past the original October 21, 2026 end date, through January 31, 2027. It lists 14.x as unsupported, which is why the October advisories name no 14.x fix.

Checklist

Before and on November 3, 2026

1. 01
   Print the installed versions of next and sharp:

   npm ls next sharp

2. 02On 16.x below 16.4.1, upgrade to 16.4.1 or later; on 15.x below 15.5.28, upgrade to 15.5.28; on 14.x or older, plan the move to 15.5.28 or 16.x.
3. 03Commit the lockfile change and redeploy, so the build installs the new version.
4. 04If you cannot upgrade yet, make sure sharp is 0.35.5 or later; the Server Actions and use cache bugs have no workaround.
5. 05On November 3, read the new advisories on the Next.js blog and GitHub, then upgrade again to the version they name.

Related

Related guides

• Failed to find Server Action "...". This request might be from an older or newer deployment.Guide
• Next.js "Uncached data was accessed outside of <Suspense>": why new apps hit it, and the fixGuide
• Failed to collect page data forGuide

Sources

Official docs behind this checklist

• Next.js blog, Upcoming Next.js November Security Release (2026-10-27)
• Next.js blog, Next.js Security Update for Upstream Vulnerabilities (2026-10-14)
• GitHub advisory GHSA-673q-mjm6-r5xr (use cache typed arrays)
• GitHub advisory GHSA-2464-fhr4-w9xw (CVE-2026-96889, Image Optimization)
• GitHub advisory GHSA-p3m5-59mp-jv5r (Server Actions denial of service)
• Next.js, Support policy

FAQ

FAQ for builders before launch