Next.js: November 2026 security fixes

# Next.js: November 2026 security fixes

Security fixes for Next.js were published on 3 November 2026. Netlify reports seven vulnerabilities and identifies versions 16.4.5 and 15.5.29 as updates for their respective release lines. Review each advisory: affected versions and exposure conditions differ by issue.

One example: cache isolation

GHSA-mfr8-8qww-v76h describes possible disclosure across root parameters when combining unstable_cache and use cache. The advisory lists versions 16.3.0 through 16.4.4 as affected and 16.4.5 as patched. GitHub classifies it as moderate. That range should not be applied to every other advisory or to version 15.

Other issues in the release involve specific cache, response, Edge route or image optimisation conditions. Read the original advisories to determine whether your application exposes the relevant features and configurations.

What to do

1. Check the installed version using your package manager and review the security notes for your release line.
2. Update to a compatible version containing the applicable fixes. The release identifies 16.4.5 and 15.5.29; also check for later updates.
3. Test the build, routes, cache, images and server features before deployment.
4. A purely static export does not run a Next.js server in production; still review dependencies and the build environment.

Frequently asked questions

Are all applications equally exposed? No. Exposure depends on the version, features and conditions described in each advisory.

Does updating eliminate all future risk? No. These versions address this release’s issues; continue monitoring later advisories.

Sources

• Next.js advisory GHSA-mfr8-8qww-v76h.
• Netlify: Next.js security release.