Security Update: Next.js and React vulnerabilities (October 2026)
By Steven Van ·
Netlify recommends upgrading Next.js to 15.5.28 or 16.4.1 and redeploying; public previews and branch deploys may remain vulnerable.
Next.js users on Netlify should upgrade next to 15.5.28 or 16.4.1 and redeploy as soon as possible. The platform’s security update covers three vulnerabilities disclosed by the Next.js and React teams on October 14: two critical remote code execution flaws and one high-severity denial of service flaw.
Cache Components and SVG processing
The Cache Components vulnerability affects Next.js 16.x apps with a use cache function that returns typed arrays. Netlify says this is an unusual configuration, but apps running on its platform that meet those conditions are affected.
The SVG vulnerability involves processing untrusted SVGs through sharp. The next/image Image Optimization API path described in the advisory is not exercised on Netlify because Netlify Image CDN handles those requests.
Apps that render untrusted input through next/og ImageResponse are affected because that code runs in a Netlify function. Netlify says the impact there is limited to a crashed function invocation, rather than code execution. Active exploitation could increase function costs. Upgrading Next.js also updates the bundled sharp library and resolves the issue.
Server Actions denial of service
The third vulnerability affects Next.js 13.x through 16.x App Router apps with at least one Server Action. Netlify says its autoscaling serverless architecture limits the impact: excessive CPU use in one function does not affect other requests. Exploitation could still increase function costs.
Check older deploys too
Both recommended Next.js versions patch all three issues. After upgrading and redeploying, check publicly available deploy previews and branch deploys. These may remain vulnerable until automatically deleted, so Netlify recommends considering manual deletion.
