Next.js ships seven security fixes: update to 16.4.5 or 15.5.29

The Next.js team published its November 2026 security release on 3 November. It fixes seven vulnerabilities in the framework. One is rated high severity and six are rated medium. The fixes ship in Next.js 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS).

The team gave advance notice of the release on 27 October, so that teams could plan the upgrade before the details were made public. The full advisories are now out, with the affected setups described for each one.

The high-severity issue

The most serious flaw affects apps that use Cache Components. When the same public use cache function is called both directly and from inside unstable_cache, and that function reads a root parameter such as a tenant identifier, a cold cache fill can return another request's result. That result can then be stored and served to later callers until it is revalidated or evicted. Where root parameters separate tenants, one tenant can see another tenant's data.

The six medium-severity issues

Most of the other fixes are also about caching:

• Nested use cache functions. Content made for one root-parameter value, such as one site or one locale, can be served to requests for another when an inner cached function returns an early value alongside a slower one.
• Binary use cache arguments. Different binary arguments can produce the same cache identity. If an app uses them to tell users apart, one caller can receive another user's cached result.
• Shared shell cache poisoning. Self-hosted apps running next start with Cache Components on and Partial Prefetching off or unset can have a shared page shell poisoned by a crafted URL. This only affects a specific route shape described in the release notes, and can cause wrong content or lasting 404 responses.
• Compressed response framing. Self-hosted apps that pass an attacker-controlled fetched Response straight back can send decompressed bytes with the original compressed headers. Behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared connection, responses can go to the wrong clients.
• Cookies in Edge routes. Edge Route Handlers and Pages Router Edge API routes that set cookies with NextResponse.cookies.set() can expose the cookie in the internal x-middleware-set-cookie header. Same-origin JavaScript can read that header, even for cookies marked HttpOnly. Node.js route handlers and cookies().set() were not affected in the reproduced case.
• SVG bypass in Image Optimization. An image from a permitted source can be misread as AVIF and get past images.dangerouslyAllowSVG: false. The release notes say this raises exposure to SVG parser problems, but does not by itself show cross-site scripting or remote code execution.

Several issues need a particular setup to be exploited. The release notes describe each one in detail, and it is worth reading the ones that match how your app is built.

How to update

The fix is to move to a patched version:

• Next.js 16: install next@16.4.5.
• Next.js 15.5: install next@15.5.29.

With npm, that is npm install next@16.4.5 or npm install next@15.5.29. Then rebuild and redeploy. A dependency update does nothing until the new build is live.

What it means for your site

• If you or your developers run a Next.js site, update now. Check package.json and your lockfile for the installed version, upgrade, and redeploy.
• Multi-tenant and multi-locale apps should look closest. Three of the seven issues involve cached content reaching the wrong tenant, locale or user. If an app serves several clients or languages from one codebase and uses Cache Components, treat this as urgent.
• Self-hosted apps have extra exposure. Two issues apply only to apps served with next start or behind certain reverse proxies.
• Check your cookies. If you set session or login cookies from Edge routes, update and review where those cookies are set.
• Agency owners: check every client project. Make a list of client sites built on Next.js and confirm each is on 16.4.5 or 15.5.29.

Sources

• Next.js: November 2026 Security Release
• Next.js: Upcoming Next.js November Security Release
• GitHub advisory GHSA-mfr8-8qww-v76h: cross-tenant cache disclosure
• GitHub advisory GHSA-f3mh-rxg3-f5g2: cookie values in an internal response header
• GitHub advisory GHSA-7qx7-33qx-rqx2: SVG rejection bypass in Image Optimization