Next.js Critical Vulnerability: Upgrading to 16.3.8
By Arash Latifi
Next.js shipped two rounds of security patches in September 2026: a critical ImageResponse RCE and a full monthly batch. Check your version, patch in two commands, and run this post-upgrade checklist.
TL;DR — September 2026 was rough for Next.js: a critical RCE (CVSS 9.5) in
next/og, followed by another full patch round. If you're on 16.2 through 16.3.5, upgrade tonext@16.3.8today — two terminal commands and a quick smoke test.
If you maintain a Next.js project and haven't updated this month, read on.
Next.js shipped two rounds of security patches in September 2026: an out-of-band fix for a critical RCE, then the monthly security release closing several more issues. Plenty of sites are still on vulnerable versions.
Round 1: ImageResponse RCE (critical — Sep 22)
Versions 16.2.0 up to (but not including) 16.3.6 carry a critical vulnerability (GHSA-vcvr-r3jv-pc5j, CVSS 9.5): the Node.js implementation of ImageResponse in next/og can lead to remote code execution.
Per the official Next.js advisory, the root cause is improper escaping of Satori's SVG output, and it only triggers when you pass attacker-controlled values into SVG content, attributes, or styles:
Two important details:
- The Edge
ImageResponseimplementation is not affected - If you never pass user input into SVG content, you're not affected — still patch, since it's an upstream dependency fix
Version 15.5.26 includes related hardening, but per the announcement Next.js 15.x is not affected by the RCE itself.
Round 2: the September 30 patches (16.3.8 / 15.5.27)
A week later, the monthly security release closed several more issues — from the official post:
| Issue | Severity | Who's affected |
|---|---|---|
| SSRF in image optimization (CVE-2026-94483) | High | Apps with images.remotePatterns configured |
| Cache poisoning of SSG/ISR pages, self-hosted (CVE-2026-94543) | Medium | Pages Router + SSG/ISR on your own server (not on Vercel) |
| Cache poisoning via root-level catch-all (CVE-2026-94484) | Medium | Root catch-all + SSG/ISR |
| dynamicParams bypass in metadata image routes (CVE-2026-94485) | Medium | App Router + webpack (Turbopack unaffected) |
| Cache leak across root params in nested 'use cache' | Medium | Cache Components enabled |
| Draft Mode content leaking via pending cache fills (CVE-2026-94544) | Medium | Cache Components + Draft Mode previews |
| Info disclosure in dev server's MCP endpoint (CVE-2026-94486) | Low | next dev only |
The two that matter most for self-hosted apps:
- Image SSRF: if you allow-list external domains via
remotePatterns, patch seriously — an allow-listed URL can be abused to reach private IP ranges - ISR cache poisoning: a single unauthenticated crafted request can swap a page's cached content with another route's, serving wrong content to every visitor until revalidation
How to check and upgrade
First, find your version:
Then patch to the current LTS for your major line:
If you use eslint-config-next or other next-scoped packages, align them too.
After upgrading, build and smoke-test:
- [ ] Verified
nextis on 16.3.8 / 15.5.27 or newer - [ ] If I use
next/og, user input never reaches SVG content/attrs/styles (or I moved to Edge runtime) - [ ] Reviewed
images.remotePatterns— only genuinely needed domains are allow-listed - [ ] If self-hosted with Pages Router + ISR, curl-checked key pages after the upgrade
- [ ] If I use Cache Components /
use cache, tested Draft Mode preview behavior - [ ] Set a monthly reminder to check Next.js security releases — they're monthly now
The new rhythm: monthly security releases
Vercel formalized a security release process this summer: patches ship monthly, with advance notice. "We were fine so we didn't update" is no longer a strategy — pick one day a month to check your version against the latest security release. For revenue-generating storefronts it's a five-minute task that removes a real risk of site compromise.
If you'd rather have someone keep your project on the latest LTS, I do exactly that in my Next.js development work — get a free estimate for a project health check.
FAQ
Q: I'm on Next.js 15 — should I worry?
For the critical RCE, no — Next.js stated 15.x is not directly affected, and 15.5.26 only includes hardening. For the September 30 patches (image SSRF, cache poisoning, and more), yes: upgrade to next@15.5.27, since several of those paths apply to 15.5 too.
Q: I use Edge runtime for ImageResponse — still worth patching?
Yes. The official advisory says the Edge implementation is not affected, but these releases close more than just ImageResponse — and you might switch runtimes later and forget.
Q: How do I know if my project is exposed to the image SSRF?
If your next.config configures images.remotePatterns (or the legacy images.domains) with external domains, you're in the CVE-2026-94483 scenario. If you've configured nothing, per the advisory your app isn't affected by that one — still update to pick up the rest.
Too busy to patch?
Patching, hardening and speed work is what I do for business sites — see my web development services or message me on Telegram.