Next.js Security Update: Patch Plan for Two Critical Flaws

If your website or web app runs on Next.js, there is an update you should look at today. On October 14, 2026, the Next.js team published a security update that fixes three vulnerabilities, two of them rated critical. This post explains what the team says, who is affected, and the rule we think every business should set for framework patches.

What Did the Next.js Team Publish?

The Next.js announcement says the update follows an earlier notice of an out-of-band security release. It includes two fixes that were postponed from the September security release because of upstream dependency delays.

• Patched versions. The fixes are in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS). The team asks you to patch your Next.js dependencies.
• The commands. npm install next@15.5.28 for the 15.5 line and npm install next@16.4.1 for the 16.4 line.

What Are the Three Issues?

Issue	Severity	Who is affected, according to the advisory
Remote code execution in use cache functions	Critical	Applications using App Router with Cache Components, where a use cache function returns multiple typed arrays. The team says there is no known workaround and advises upgrading immediately, even if your application does not have similar functions.
Remote code execution in the Image Optimization API with SVG files	Critical	Applications where Next.js runs on glibc-based Linux. The cause is a memory-related flaw in an upstream library. As a workaround, make sure the version of sharp used by Next.js is 0.35.5 or later. Upgrading Next.js lets package managers provide a fixed version.
Denial of service through Server Actions	High	Applications using App Router with at least one Server Action. Crafted requests can cause excessive CPU use that blocks other requests in the same process. Applications using Pages Router, or no Server Actions, are not vulnerable.

The advisory describes the first two as unauthenticated, meaning an attacker does not need to sign in.

Why Should Business Teams Care?

Most companies do not track framework versions. The website was built, it works, and nobody has looked at its dependencies since. That is exactly the situation a notice like this exposes.

• You may not know which version you run. The answer sits in a file in your code repository, and it may be with an agency or a former contractor.
• Critical means the vendor wants it fixed now. For the cache issue, the team says to upgrade even if your application does not have similar functions.
• A patch is not finished when the package is changed. The site must be rebuilt, tested and deployed before the fix reaches your visitors.
• Exposure depends on how your app is built. The announcement ties each issue to a specific setup, as the table shows. Check your own setup against it instead of assuming you are safe or affected.

A Short Checklist for This Update

1. Find your version. Check the next entry in your project’s package.json and lock file.
2. Check which line you are on. Patched versions exist for the 16.4 and 15.5 lines. If you are on another line, read the full advisory before you decide.
3. Update and rebuild. Install the patched version, run your tests and build the project.
4. Deploy and confirm. The fix only counts once the new build is live.
5. Know what sharp covers. If you cannot upgrade right away, the advisory’s workaround is a sharp version of 0.35.5 or later. It mitigates only the image optimization issue. The cache issue has no known workaround, so it needs the upgrade.
6. Read the original advisories. The Next.js post links each GitHub advisory with full details.

The Rule to Adopt

Every framework your business depends on needs a named owner and a set window for security patches, so a critical notice is handled in days, not discovered months later.

How Incresco Helps

Incresco is a Claude partner. We build web and mobile applications, cloud systems, Salesforce solutions, WhatsApp experiences and AI agents. For teams running web applications, we help set up the habits around them: who tracks versions, how patches are tested, and how fixes reach production. See our AI transformation, custom platform development and cloud services.

Not sure which version your website runs, or who looks after it? Contact Incresco and ask for a web platform patch review. We will check what your applications run today, tell you what needs updating first, and help you set the patch process so the next notice is routine.