next
- 16.4.1 is the latest, published 14 October 2026.
- 73 security advisories, all fixed.
- 16.x: 44 releases since 22 October 2025, 21 in the last 90 days.
Security advisories
Grouped by the version that fixes them, so one upgrade reads as one step.
Fixed in 16.3.8 · 6 advisories
- HIGHNext.js has Server-Side Request Forgery in Image OptimizationGHSA-cjq9-62q9-8jv4
- MODERATENext.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesGHSA-3w37-wq28-93x7
- MODERATENext.js has cache poisoning of SSG and ISR pages in self-hosted applicationsGHSA-4jqv-mc3x-m676
3 more
- MODERATENext.js has information disclosure in App Router metadata image routes via dynamicParams bypassGHSA-f87g-xv8r-7p7x
- MODERATENext.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of serviceGHSA-mcj8-r9mp-w47p
- LOWNext.js has information disclosure in development server's Model Context Protocol endpointGHSA-39w2-rjm5-chcv
Fixed in 16.3.6 · 1 advisory
- CRITICALNext.js: Remote Code Execution in next/og ImageResponseGHSA-vcvr-r3jv-pc5j
Fixed in 16.3.3 · 2 advisories
- CRITICALNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedGHSA-2xp9-vwfh-vxw4
- CRITICALNext.js: Unauthenticated Remote Code Execution on windows-hosted serversGHSA-p293-qw3h-jr36
Fixed in 16.2.11 · 9 advisories
- HIGHNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localeGHSA-6gpp-xcg3-4w24
- HIGHNext.js: Server-Side Request Forgery in Server Actions on custom serversGHSA-89xv-2m56-2m9x
- HIGHNext.js: Denial of Service in App Router using Server ActionsGHSA-m99w-x7hq-7vfj
6 more
- HIGHNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameGHSA-p9j2-gv94-2wf4
- MODERATENext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequencesGHSA-4633-3j49-mh5q
- MODERATENext.js: Unbounded Server Action payload in Edge runtimeGHSA-4c39-4ccg-62r3
- MODERATENext.js: Cache confusion of response bodies for requests with bodiesGHSA-68g3-v927-f742
- MODERATENext.js: Unauthenticated disclosure of internal Server Function endpointsGHSA-955p-x3mx-jcvp
- MODERATENext.js: Denial of Service in the Image Optimization API using SVGsGHSA-q8wf-6r8g-63ch
36 older fixes
Fixed in 16.2.6 · 1 advisory
Fixed in 16.2.5 · 12 advisories
- HIGHNext.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routesGHSA-267c-6grr-h53f
- HIGHNext.js has a Middleware / Proxy bypass in Pages Router applications using i18nGHSA-36qx-fr4f-26g5
- HIGHNext.js has a Middleware / Proxy bypass through dynamic route parameter injectionGHSA-492v-c6pp-mqqv
9 more
- HIGHNext.js Vulnerable to Denial of Service with Server ComponentsGHSA-8h8q-6873-q5fj
- HIGHNext.js vulnerable to server-side request forgery in applications using WebSocket upgradesGHSA-c4j6-fc7j-m34r
- HIGHNext.js vulnerable to Denial of Service via connection exhaustion in applications using Cache ComponentsGHSA-mg66-mrh9-m8jx
- MODERATENext.js vulnerable to cross-site scripting in App Router applications using CSP noncesGHSA-ffhc-5mcf-pf4q
- MODERATENext.js has cross-site scripting in beforeInteractive scripts with untrusted inputGHSA-gx5p-jg67-6x7h
- MODERATENext.js has a Denial of Service in the Image Optimization APIGHSA-h64f-5h5j-jqjh
- MODERATENext.js vulnerable to cache poisoning in React Server Component responsesGHSA-wfc6-r584-vfw7
- LOWNext.js's Middleware / Proxy redirects can be cache-poisonedGHSA-3g8h-86w9-wvmq
- LOWNext.js vulnerable to cache poisoning via collisions in React Server Component cache-bustingGHSA-vfv6-92ff-j949
Fixed in 16.2.3 · 1 advisory
- HIGHNext.js has a Denial of Service with Server ComponentsGHSA-q4gf-8mx6-v5v3
Fixed in 16.1.7 · 5 advisories
- MODERATENext.js: Unbounded next/image disk cache growth can exhaust storageGHSA-3x4c-7xq6-9pq8
- MODERATENext.js: HTTP request smuggling in rewritesGHSA-ggv3-7p47-pfv8
- MODERATENext.js: Unbounded postponed resume buffering can lead to DoSGHSA-h27x-g6w4-24gq
2 more
- MODERATENext.js: null origin can bypass Server Actions CSRF checksGHSA-mq59-m269-xvcx
- LOWNext.js: null origin can bypass dev HMR websocket CSRF checksGHSA-jcc7-9wpm-mj36
Fixed in 16.1.5 · 3 advisories
- HIGHNext.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsGHSA-h25m-26qc-wcjf
- MODERATENext.js has Unbounded Memory Consumption via PPR Resume Endpoint GHSA-5f7q-jpqc-wp7h
- MODERATENext.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationGHSA-9g9p-9gw9-jx7f
Fixed in 16.1.0-canary.19 · 1 advisory
- HIGHNext has a Denial of Service with Server Components - Incomplete Fix Follow-UpGHSA-5j59-xgg2-r9c4
Fixed in 16.1.0-canary.17 · 2 advisories
- HIGHNext Vulnerable to Denial of Service with Server ComponentsGHSA-mwv6-3258-q52c
- MODERATENext Server Actions Source Code Exposure GHSA-w37m-7fhw-fmv9
Fixed in 16.0.7 · 1 advisory
- CRITICALNext.js is vulnerable to RCE in React flight protocolGHSA-9qr9-h5gf-34mp
Fixed in 15.4.7 · 1 advisory
- MODERATENext.js Improper Middleware Redirect Handling Leads to SSRFGHSA-4342-x723-ch2f
Fixed in 15.4.5 · 2 advisories
- MODERATENext.js Affected by Cache Key Confusion for Image Optimization API RoutesGHSA-g5qg-72qw-gw5v
- MODERATENext.js Content Injection Vulnerability for Image OptimizationGHSA-xv57-4mr9-wg8v
Fixed in 15.3.3 · 1 advisory
- LOWNext.js has a Cache poisoning vulnerability due to omission of the Vary headerGHSA-r2fc-ccr8-96c4
Fixed in 15.2.4 · 1 advisory
- LOWNext.js may leak x-middleware-subrequest-id to external hostsGHSA-223j-4rm8-mrmf
Fixed in 15.2.3 · 1 advisory
- CRITICALAuthorization Bypass in Next.js MiddlewareGHSA-f82v-jwr5-mffw
Fixed in 15.2.2 · 1 advisory
- LOWInformation exposure in Next.js dev server due to lack of origin verificationGHSA-3h52-269p-cp9r
Fixed in 15.1.8 · 1 advisory
- HIGHNext.JS vulnerability can lead to DoS via cache poisoning GHSA-67rr-84xm-4c7r
Fixed in 15.1.6 · 1 advisory
- LOWNext.js Race Condition to Cache PoisoningGHSA-qpjv-v59x-3qc4
Fixed in 15.1.2 · 1 advisory
- MODERATENext.js Allows a Denial of Service (DoS) with Server ActionsGHSA-7m27-7ghc-44w9
Fixed in 14.2.15 · 1 advisory
- HIGHNext.js authorization bypass vulnerabilityGHSA-7gfc-8cq8-jh5f
Fixed in 14.2.10 · 1 advisory
- HIGHNext.js Cache PoisoningGHSA-gp8f-8m3g-qvj9
Fixed in 14.2.7 · 1 advisory
- MODERATEDenial of Service condition in Next.js image optimizationGHSA-g77x-44xx-532m
Fixed in 14.1.1 · 1 advisory
- HIGHNext.js Server-Side Request Forgery in Server ActionsGHSA-fr5h-rqp8-mj6g
Fixed in 13.5.1 · 1 advisory
- HIGHNext.js Vulnerable to HTTP Request SmugglingGHSA-77r5-gw3j-2mpf
Fixed in 13.5.0 · 1 advisory
- HIGHNext.js Denial of Service (DoS) conditionGHSA-fq54-2j52-jc42
Fixed in 13.4.20-canary.13 · 1 advisory
- LOWNext.js missing cache-control header may lead to CDN caching empty replyGHSA-c59h-r6p8-q9wc
Fixed in 12.2.4 · 1 advisory
- MODERATEUnexpected server crash in Next.jsGHSA-wff4-fpwg-qqv3
Fixed in 12.1.0 · 1 advisory
- MODERATEImproper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0GHSA-fmvm-x8mv-47mj
Fixed in 12.0.9 · 1 advisory
- MODERATEDenial of Service Vulnerability in next.jsGHSA-wr66-vrwm-5g5x
Fixed in 12.0.5 · 1 advisory
- HIGHUnexpected server crash in Next.js.GHSA-25mp-g6fv-mqxx
Fixed in 11.1.1 · 1 advisory
- HIGHXSS in Image Optimization API for Next.jsGHSA-9gr3-7897-pp7m
Fixed in 11.1.0 · 1 advisory
- MODERATEOpen Redirect in Next.jsGHSA-vxf5-wxwp-m7g9
Fixed in 9.5.4 · 1 advisory
- MODERATEOpen Redirect in Next.js versionsGHSA-x56p-c8cg-q435
Fixed in 9.3.2 · 1 advisory
- MODERATEDirectory Traversal in Next.jsGHSA-fq77-7p7r-83rj
Fixed in 7.0.2 · 1 advisory
- MODERATENext.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error pageGHSA-qw96-mm2g-c8m7
Fixed in 5.1.0 · 1 advisory
- HIGHRemote Code Execution in nextGHSA-5vj8-3v2h-h38v
Fixed in 4.2.3 · 1 advisory
- HIGHDirectory traversal vulnerability in Next.jsGHSA-m34x-wgrh-g897
Fixed in 2.4.1 · 1 advisory
- HIGHNext.js Directory Traversal VulnerabilityGHSA-3f5c-4qxj-vmpf
Releases in the last 90 days
Feed of releases and advisoriesEvery stable release, newest first. Notes are quoted as the maintainers published them.
16.4.1
14 October 2026This release contains security fixes for the following advisories:
This release contains security fixes for the following advisories:
Critical:
- security
Unauthenticated Remote Code Execution in
use cachefunctions returning typed arrays - security
Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
High:
- security
15.5.28
14 October 2026This release contains security fixes for the following advisories:
This release contains security fixes for the following advisories:
Critical:
High:
16.4.0
6 October 2026Check out the 16.4 announcement post to get an overview of the changes.
Check out the 16.4 announcement post to get an overview of the changes.
Core Changes
Show compiler plugin warning in more situations
fix(scripts): correct typo in rm.mjs error message
Fix debug build paths Pages Router support entries
bundle-analyzer: record historical snapshots on each analyze run
fix: detect proxy.ts correctly with compound pageExtensions
feat(turbopack): support
falsevalues forresolveAliasconfig
15.5.27
30 September 2026This release contains security fixes for the following advisories:
This release contains security fixes for the following advisories:
Medium:
16.3.8
30 September 2026This release contains security fixes for the following advisories:
This release contains security fixes for the following advisories:
High:
Medium:
- security
Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
- security
Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
- security
- security
Pending
use cachefill can leak Draft Mode content into regular responses and persisted pages - security
Cache leak across root param values in nested 'use cache' functions
Low:
- security
16.3.7
29 September 2026turbo-tasks-backend: fix strongly consistent read hanging on a canceled task
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
turbo-tasks-backend: fix strongly consistent read hanging on a canceled task
15.5.26
22 September 2026This release contains additional security hardening for next/og. For more information, check out nextjs.org/blog/nextjs-security-update-septembe…
This release contains additional security hardening for
next/og. For more information, check out nextjs.org/blog/nextjs-security-update-septembe…16.3.6
22 September 2026This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse
This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse
16.3.5
11 September 202616.3.4
31 August 2026
Show 11 earlier releases
15.5.25
31 August 202615.5.24
25 August 202616.3.3
25 August 202616.3.2
21 August 202616.3.1
13 August 202615.5.23
6 August 202616.3.0
3 August 202616.2.12
25 July 202615.5.22
25 July 202616.2.11
21 July 202615.5.21
21 July 2026
Major versions
- 16.xsince 22 October 2025 · latest 16.4.1 · 44 releases
- 15.xsince 21 October 2024 · latest 15.5.28 · 82 releases
- 14.xsince 26 October 2023 · latest 14.2.35 · 46 releases
- 13.xsince 25 October 2022 · latest 13.5.11 · 56 releases
- 12.xsince 26 October 2021 · latest 12.3.7 · 33 releases
- 11.xsince 15 June 2021 · latest 11.1.4 · 7 releases
- 10.xsince 27 October 2020 · latest 10.2.3 · 18 releases
- 9.xsince 8 July 2019 · latest 9.5.5 · 38 releases
- 8.xsince 11 February 2019 · latest 8.1.0 · 6 releases
- 7.xsince 19 September 2018 · latest 7.0.3 · 4 releases
- 6.xsince 29 April 2018 · latest 6.1.2 · 7 releases
- 5.xsince 5 February 2018 · latest 5.1.0 · 2 releases
- 4.xsince 9 October 2017 · latest 4.2.3 · 15 releases
- 3.xsince 9 August 2017 · latest 3.2.3 · 11 releases
- 2.xsince 27 March 2017 · latest 2.4.9 · 17 releases
- 1.xsince 25 October 2016 · latest 1.2.3 · 10 releases
- 0.xsince 11 July 2011 · latest 0.9.11 · 26 releases
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
Reading npm and deps.dev…
Registry facts last checked 15 October 2026. Releases and advisories last read 15 October 2026.
Know when your own dependencies move
Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.