Between August and October 2026, several critical remote code execution advisories were published for Next.js. Which versions were affected, what to do, and how to make staying current a routine.
What happened?
Between August and October 2026, several security advisories rated critical (CVSS 9.5) were published for Next.js. What they had in common was the risk of an unauthenticated attacker running code on the server (RCE). Some of the flaws were in Next.js itself; others were in sharp, the library used for image optimization, and its dependencies.
Which advisories?
The flaw triggered while optimizing AVIF images was fixed in 16.3.3, and the one involving user input passed into SVG content while generating images with next/og was fixed in 16.3.6. Two critical advisories published in mid-October — SVG image optimization, and “use cache” functions returning typed arrays in apps using Cache Components — were fixed in 16.4.1. The same period also brought an advisory affecting apps hosted on Windows servers, along with lower-severity cache poisoning, SSRF and denial-of-service advisories.
Is your site affected?
Not every advisory affects every app: some only matter if you use image optimization, others only if a specific feature is enabled. Rather than analysing each one, the rule is simple: on Next.js 16, move to at least 16.4.1; on the 15 line, move to 15.5.28 or later. We moved our own site to 16.4.3, confirmed it uses a fixed sharp release (0.35.5 or later) and brought the dependency scan down to zero warnings.
Updating safely
A dependency update is not just typing “npm audit fix”. Update packages together with the lock file, run a production build, test critical pages and forms, then ship. For major-version jumps — React 18 to 19, say — scan the codebase for removed APIs. Small, regular updates are always safer than big, scary migrations.
Make staying current a routine
GitHub’s Dependabot alerts, or a similar scanner, tell you on the day an advisory is published. Wire that into a CI pipeline where every change is built and tested automatically, and a critical patch can ship within hours. This is one of the most tangible benefits of DevOps.
Saying less is security too
Do not publish the exact versions of the libraries you use, your database structure or internal service names on public pages; attackers match known vulnerabilities to version numbers. That is why our portfolio describes technology at the capability level, without versions.
Summary
Update Next.js to at least 16.4.1 (we run 16.4.3), check that sharp is 0.35.5 or later, test the update before shipping, and set up a routine that tracks dependency alerts. If you would like, our maintenance and DevOps service can run this process for you.
