Next.js November 2026 security release: update to 16.4.5 or 15.5.29
Ship ItChecked against the official source
Source checked 4 Nov 2026 · Published 4 Nov 2026 · Last reviewed 4 Nov 2026 · By Ctrl+Z Therapy (how we test)
The short answer
The Next.js blog of November 3, 2026: updates are now available in v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) to address seven issues, one High and six Medium. Several are about caching, where in some setups a caller can receive another user's cached result. Next.js says: please patch your Next.js dependencies to maintain the security of your applications.
What to do
- Check which Next.js version your app uses in package.json.
- Update: npm install next@16.4.5, or npm install next@15.5.29 if you're on 15.5.
- Run the build, then redeploy.
Good to know
- The fixes cover cache disclosure with unstable_cache and use cache (High), nested use cache functions, binary use cache arguments, shared shell cache poisoning in self-hosted apps, stale compressed response framing behind certain proxies, cookie values exposed in Edge routes, and an SVG bypass in Image Optimization.
- Most require specific setups, described in each advisory.
- The advance notice of October 27 said seven medium vulnerabilities; the release lists one High and six Medium.
Source
Checked on 4 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.