Security Update: Next.js and React vulnerabilities (October 2026)

If you run Next.js on Netlify, Netlify recommends upgrading next to 15.5.28 or 16.4.1 and redeploying as soon as possible. Both versions patch three disclosed vulnerabilities: two critical remote code execution flaws and one high-severity denial of service flaw.

The Cache Components flaw affects Next.js 16.x apps with a use cache function returning typed arrays. Netlify's Image CDN avoids the affected next/image path, but apps rendering untrusted input through next/og ImageResponse are affected. Netlify says that impact is limited to a crashed function invocation.

The Server Actions flaw affects Next.js 13.x through 16.x App Router apps with at least one Server Action. Netlify says its architecture limits the impact on other requests, though exploitation of this or the ImageResponse issue could increase function costs.

Check publicly available deploy previews and branch deploys too. They may remain vulnerable after your main deployment is updated, so Netlify recommends considering manual deletion.