IT & SecurityCreated on October 25, 20262 min read

Next.js: three security fixes to check before your next deployment

The October 14 update covers Cache Components, SVG image processing and Server Actions. Patched lines start at 16.4.1 and 15.5.28.

What changed

The October 14 Next.js update addresses two critical code-execution issues and one high-severity denial of service. Patched releases are 16.4.1 and 15.5.28. Check all three advisories; the feature conditions differ.

Who should check

The cache issue affects Next 16.0.0–16.4.0 applications using Cache Components with a use cache function returning multiple typed arrays. The image issue concerns SVG processing through Image Optimization on glibc Linux. The denial of service requires App Router with a Server Action; Pages Router and applications without Server Actions are not affected by that specific issue.

What to do

Read the exact version ranges and feature conditions in the linked advisories. Inventory the lockfile and the packages actually deployed.
Upgrade your supported Next.js line to a fixed release or a later compatible patched version. The image-specific sharp 0.35.5 workaround does not fix the cache or Server Actions issues.
Build in staging and check image handling, cached responses, forms and error paths before deployment.

Reference commands

Read-only dependency inventory; use your project package manager

npm ls next react react-dom sharp

Verify the result

Record the deployed Next.js version after the service is replaced. An affected version warrants remediation review; it does not by itself prove exploitation.

Official sources

Take it into your project

Get the files, keep the guide, or give your coding assistant a ready-to-use brief.

Download guideMarkdown Download AI setup briefEnglish · Markdown

Set it up with AI

Copy this English prompt into your coding assistant. It includes the article, available files and project setup steps.

View the setup prompt

AI setup prompt · English

Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/nextjs-october-2026-security-update?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Audit my Next.js project against https://nextjs.org/blog/nextjs-security-update-october-14-2026 and its three linked vendor advisories. Inventory exact locked and deployed next, react, react-dom and sharp versions. Check Cache Components/use cache functions returning multiple typed arrays, SVG Image Optimization on glibc Linux, and App Router Server Actions separately. Plan an upgrade to at least next 16.4.1 on the 16 line or 15.5.28 on the 15 line, or a later confirmed patched compatible release. Updating sharp alone only addresses the image issue, not the other advisories. Respect the existing lockfile and package manager. Propose local changes, build and regression checks, and a rollback plan. Do not infer compromise from an affected version. Stop before production deployment.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.

The prompt

Audit my Next.js project against https://nextjs.org/blog/nextjs-security-update-october-14-2026 and its three linked vendor advisories. Inventory exact locked and deployed next, react, react-dom and sharp versions. Check Cache Components/use cache functions returning multiple typed arrays, SVG Image Optimization on glibc Linux, and App Router Server Actions separately. Plan an upgrade to at least next 16.4.1 on the 16 line or 15.5.28 on the 15 line, or a later confirmed patched compatible release. Updating sharp alone only addresses the image issue, not the other advisories. Respect the existing lockfile and package manager. Propose local changes, build and regression checks, and a rollback plan. Do not infer compromise from an affected version. Stop before production deployment.

Read the original sourceNext.js · 14 October security update

Next.jsReactSecurityServer Actions