Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Next.js security update October 2026: update to 16.4.1 or 15.5.28 and redeploy

Ship ItChecked against the official source

Source checked 24 Oct 2026 · Published 29 Oct 2026 · Last reviewed 29 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

On October 14, 2026, Next.js published a security update for three vulnerabilities. Two are critical and allow unauthenticated remote code execution: attackers can run code on your server without logging in. Updates are available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS), and Next.js says you should upgrade immediately even if your application does not have similar functions.

What to do

  1. Check which version of Next.js (the next package) your app uses.
  2. Update it to 16.4.1, or to 15.5.28 if you're on version 15, and run the build.
  3. Redeploy. On Netlify, publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted, so consider deleting them manually.
  4. Ask your AI tool: "Check which Next.js version this app uses. If it's older than 16.4.1 (or 15.5.28 on version 15), update it, run the build, and tell me what changed."

Good to know

  • The three issues: unauthenticated remote code execution in use cache functions returning typed arrays (critical), unauthenticated remote code execution in the Image Optimization API when using SVG (critical), and denial of service in App Router using Server Actions (high). For the first, Next.js says there is no known workaround for affected applications.
  • Netlify notes that some of these issues have limited impact on its platform, and still recommends upgrading next to 15.5.28 or 16.4.1 and redeploying.

Source

Checked on 24 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.