Next.js Security Update November 2026: Upgrade to 16.4.5 or 15.5.29

What Shipped on 3 November

Next.js announced the release a week early, on 27 October, and published it on 3 November: 16.4.5 for the Active LTS line and 15.5.29 for the Maintenance LTS line (Next.js blog, GitHub releases).

GitHub rates all seven advisories Moderate, with CVSS 4.0 scores from 6.0 to 6.9. The Next.js blog post labels one of them, the unstable_cache disclosure, High. Neither page lists a fix for 14.x or older, and none of the November advisories' affected ranges include 14.x.

Most of these bugs need a specific feature or hosting setup to matter. That is good news, but it means you have to know which features your app uses. If an AI tool wrote your app, it may use the use cache directive or Edge routes without you having chosen them.

The Seven Advisories

Two advisories come with a workaround. For CVE-2026-119350, set partialPrefetching: true in next.config. For CVE-2026-119790, stop calling the 'use cache' function through unstable_cache(). The other five list no workaround, so upgrading is the fix.

Are You Affected?

Start with the version you actually run, not the one in package.json. The lockfile decides what gets installed:

# Prints the installed next version
npm ls next

If it shows 16.4.5, 15.5.29 or later on those lines, you have the November fixes. If not, check which of the risky features your code uses (in a macOS or Linux terminal, or Git Bash on Windows):

grep -rn --exclude-dir=node_modules --exclude-dir=.next \
  -e "use cache" -e "unstable_cache" -e "runtime = 'edge'" -e "dangerouslyAllowSVG" .

No hits does not mean you can skip the upgrade. Five of the seven advisories list no workaround, and staying behind makes the next upgrade harder. The advisories also do not say Vercel patches your app for you: the fixes ship in the next package, so they reach production when you upgrade and redeploy.

If You Skipped October's Release

The November fixes sit on top of a bigger 14 October update. Its headline bug is CVE-2026-96889: unauthenticated remote code execution in the Image Optimization API when SVG files are used. It is rated Critical (CVSS 4.0 score 9.5) and applies when Next.js runs on glibc-based Linux.

• Affected: every version from 10.0.0 to 15.5.27, and versions after 16.0.0 up to 16.4.0. That includes all of 14.x.
• Fixed: 15.5.28 and 16.4.1, so the November versions are outside the affected range.
• Workaround if you cannot upgrade today: make sure the sharp version Next.js uses is 0.35.5 or later.

The same October release fixed a second critical bug in use cache with typed arrays (GHSA-673q-mjm6-r5xr, no workaround) and a high-severity denial of service in Server Actions (GHSA-p3m5-59mp-jv5r). If your app is on 14.x, no 14.x fix is listed for any of these, so the path forward is a major upgrade to 15.5.29 or 16.4.5.

How to Update Safely

The common failure is not forgetting to upgrade. It is upgrading on one machine while the lockfile, CI or the deployed build still uses the old version.

// Bad: pinned to a version inside the affected ranges
{
  "dependencies": {
    "next": "15.5.20"
  }
}

// Fixed: an exact patched version, committed together with the lockfile
{
  "dependencies": {
    "next": "15.5.29"
  }
}

1. Run the install command for your line: npm install next@16.4.5 or npm install next@15.5.29.
2. Commit package.json and the lockfile together, so CI installs the same version.
3. Run your build and tests, then redeploy. A fix that is not deployed protects nothing.
4. Run npm ls next again in CI or the build log to confirm what shipped.

VibeDoctor's Vibe Check runs Trivy against your lockfile and flags dependencies with known CVEs in its vulnerability database, with the installed version and the version that fixes it. It also flags loose version ranges and a missing lockfile. Free to sign up.

For the code-level side of Next.js security, see Server Actions pitfalls in AI-written code and how CVE scanning with Trivy works.

FAQ