September 2026 Security Release

Sebastian Silbermann,

Josh Story,

Karim Rahal

Last week we announced an upcoming security release for Next.js. A fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays.

Updates are now available in v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.

npm install [email protected]  # for 15.5
npm install [email protected]   # for 16.3

Copy link to headingImpact

Copy link to headingServer-Side Request Forgery in Image Optimization (High Severity)

CVE-2026-94483 / GHSA-cjq9-62q9-8jv4

An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no

images.remotePatterns

are configured, your application is not affected.

Copy link to headingCache poisoning of SSG and ISR pages in self-hosted Next.js applications (Medium Severity)

CVE-2026-94543 / GHSA-4jqv-mc3x-m676

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Copy link to headingCache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service (Medium Severity)

CVE-2026-94484 / GHSA-mcj8-r9mp-w47p

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.

Copy link to headingInformation disclosure in Next.js App Router metadata image routes via dynamicParams bypass (Medium Severity)

CVE-2026-94485 / GHSA-f87g-xv8r-7p7x

In Next.js App Router applications built with webpack, metadata image routes such as

opengraph-image

and

twitter-image

ignore the

dynamicParams

route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from

generateStaticParams()

. Applications built with Turbopack are not affected.

Copy link to headingCache leak across root param values in nested 'use cache' functions (Medium Severity)

With Cache Components enabled, a

'use cache'

function that calls another

'use cache'

function that reads a root param can be keyed incorrectly: the enclosing function's cache key omits that root param, so content produced for one root param value can be served for a different value, whether the page is prerendered or rendered dynamically. What values are leaked cannot be attacker controlled.

Copy link to headingPending use cache fill can leak Draft Mode content into regular responses and persisted pages (Medium Severity)

CVE-2026-94544 / GHSA-3w37-wq28-93x7

Pending

use cache

fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. A regular request that overlaps an editor's Draft Mode request receives unpublished content without any authentication; if that request prerenders a page, the unpublished content can be persisted into the generated page and served to all later visitors until the page is revalidated. Sites are affected if they enable Cache Components (or

experimental.useCache

) and serve Draft Mode previews whose cached functions return draft-dependent content.

Copy link to headingInformation disclosure in the Next.js development server's Model Context Protocol endpoint (Low Severity)

CVE-2026-94486 / GHSA-39w2-rjm5-chcv

The Next.js development server (

next dev

) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data, including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with

next dev

are affected. Production deployments do not serve this endpoint.

Copy link to headingOur security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].