Next.js September 2026 Security Release: What Developers Need to Know

The Next.js September 2026 security release is now available, and developers using Next.js should update their applications as soon as practical.

On September 30, 2026, the Next.js team released Next.js 16.3.8 for the Active LTS branch and Next.js 15.5.27 for the Maintenance LTS branch. The release addresses seven security vulnerabilities, including one high-severity issue, five medium-severity issues, and one low-severity issue.

The vulnerabilities affect different parts of the framework, including image optimization, caching, the App Router, Cache Components, Draft Mode, and the development server.

What Is the Next.js September 2026 Security Release?

The September 2026 security release is a set of security patches for supported Next.js versions.

The official Next.js announcement recommends updating dependencies to:

npm install next@15.5.27


for Next.js 15.5, or:

npm install next@16.3.8


for Next.js 16.3.

Next.js currently lists 16.x as Active LTS and 15.x as Maintenance LTS. Active LTS releases receive new features, bug fixes, performance improvements, and security patches, while Maintenance LTS focuses on critical fixes and security updates.

Why Should Next.js Developers Update?

Security updates are important because some of the vulnerabilities in this release can affect how an application handles remote resources, cached pages, generated content, or development-server data.

Not every Next.js application is affected by every vulnerability. The impact depends on how your application is configured and which Next.js features you use.

However, the official recommendation is straightforward: patch your Next.js dependency to a fixed version.

Next.js Security Vulnerabilities Fixed in September 2026

The September release addresses seven vulnerabilities. Here's what developers should know about each one.

1. Server-Side Request Forgery in Image Optimization

Severity: High

The highest-severity issue in this release affects Next.js Image Optimization when applications use configured remote image patterns.

An attacker-controlled URL that has been allow-listed can potentially cause the server to make requests to private IP ranges.

This vulnerability is tracked as CVE-2026-94483.

There is an important configuration detail: according to the Next.js security advisory, applications that do not configure images.remotePatterns are not affected by this particular vulnerability.

If your application uses remote images, this is one of the first areas worth checking.

2. Cache Poisoning in Self-Hosted Next.js Applications

Severity: Medium

The second issue affects certain self-hosted applications using the Pages Router, particularly applications using Static Site Generation (SSG) or Incremental Static Regeneration (ISR).

Under the affected conditions, a cache entry for one route could be replaced with content belonging to another route. That incorrect content could then be served to visitors until the cache entry was revalidated.

The Next.js team specifically notes that applications deployed on Vercel are not affected by this issue.

3. Cache Poisoning in SSG and ISR Rendering

Severity: Medium

Another cache-related vulnerability can affect applications using a root-level catch-all page together with SSG or ISR routes.

A single unauthenticated crafted request could potentially poison a shared response cache. The result could include cross-user content substitution and persistent denial of service until the affected cache was refreshed.

This is particularly relevant for applications that rely heavily on static generation and shared caching.

4. Information Disclosure Through Metadata Image Routes

Severity: Medium

The fourth vulnerability involves Next.js App Router applications built with webpack.

Metadata image routes such as:

• opengraph-image
• twitter-image

could ignore the dynamicParams route segment setting under certain circumstances.

This could allow an attacker to request metadata image URLs for dynamic segments that were intentionally excluded from generateStaticParams().

There's also an important distinction here: applications built using Turbopack are not affected by this vulnerability.

5. Cache Leak Across Root Parameters

Severity: Medium

Another issue affects applications using Cache Components.

When a 'use cache' function calls another 'use cache' function that reads a root parameter, the cache key could be generated incorrectly. In certain situations, content associated with one root parameter could be served for another parameter.

The advisory notes that the leaked values cannot be controlled by an attacker.

6. Draft Mode Content Could Reach Regular Responses

Severity: Medium

This vulnerability concerns applications using Cache Components or the experimental useCache feature together with Draft Mode.

Under the affected conditions, a regular request could overlap with an editor's Draft Mode request and receive unpublished content.

In some cases, that unpublished content could also become part of a generated page and subsequently be served to other visitors until the page was revalidated.

If your application uses Draft Mode for content previews, this vulnerability deserves particular attention.

7. Information Disclosure in the Next.js Development Server

Severity: Low

The final vulnerability affects the Next.js development server, specifically next dev.

The development server exposes a Model Context Protocol (MCP) endpoint that does not sufficiently verify the origin of requests. A malicious website visited by a developer could potentially use this to access sensitive development information, including project paths, source-code snippets from error reports, route information, and development logs.

The important limitation is that this issue affects development environments. Production deployments do not serve this endpoint.

Which Next.js Versions Should You Upgrade To?

For the versions covered by this release, the patched versions are:

Current Branch

Patched Version

Support Status

Next.js 16.3

16.3.8

Active LTS

Next.js 15.5

15.5.27

Maintenance LTS

Next.js recommends using supported Active LTS or Maintenance LTS releases for production applications.

How to Update Next.js

Updating is straightforward if your project is already using one of the affected branches.

For Next.js 16.3:

npm install next@16.3.8


For Next.js 15.5:

npm install next@15.5.27


After updating, reinstall your dependencies if necessary, run your test suite, and build the application before deploying it to production.

A typical workflow might look like:

npm install next@16.3.8
npm run build
npm test


The exact commands will depend on your project's package manager and testing setup.

What Should Developers Check After Updating?

A version upgrade is a good opportunity to review the parts of your application related to the vulnerabilities in this release.

Check remote image configuration

If you're using Next.js Image Optimization with remote images, review your images.remotePatterns configuration.

Only allow the remote hosts and URL patterns your application actually needs.

Review SSG and ISR

If your application uses:

• Static Site Generation
• Incremental Static Regeneration
• the Pages Router
• catch-all routes
• self-hosted caching

review your caching setup and make sure your application is running the patched Next.js version.

Review Cache Components

Applications using Cache Components or use cache should pay particular attention to cached functions that depend on route parameters.

Check Draft Mode

If your CMS integration uses Draft Mode or preview functionality, test both:

1. authenticated/editor preview requests, and
2. normal public requests.

Make sure unpublished content remains isolated from regular visitors.

Review your development environment

Teams should also update local development environments rather than updating only production.

The low-severity MCP issue specifically affects next dev, so keeping developer machines on patched versions is part of a complete security update.

Does This Affect Every Next.js Application?

No.

The seven vulnerabilities have different prerequisites, and the official advisory identifies configurations that are not affected by particular issues.

For example:

• The image optimization SSRF does not affect applications without images.remotePatterns.
• The self-hosted SSG/ISR cache issue does not affect applications deployed on Vercel.
• The metadata image vulnerability does not affect applications built with Turbopack.
• The Draft Mode cache issue requires Cache Components or experimental useCache together with affected Draft Mode behavior.
• The MCP issue affects next dev, not production deployments.

That doesn't mean an upgrade should be skipped. It means developers should understand which parts of their application's architecture are relevant.

Next.js September 2026 Security Release: Key Takeaway

The September 2026 Next.js security release is an important maintenance update for developers running supported Next.js applications.

The release fixes seven vulnerabilities across different areas of the framework, with severity ranging from Low to High. The most serious issue involves Server-Side Request Forgery in Image Optimization, while several others involve cache poisoning, information disclosure, Cache Components, Draft Mode, and the development server.

If you're running Next.js 16.3, update to 16.3.8. If you're on Next.js 15.5, update to 15.5.27.

After upgrading, test your application's image handling, caching, routing, preview functionality, and production build before deploying.

Security releases can sometimes look like routine dependency updates, but they are an important part of keeping a Next.js application safe and reliable in production.

Official reference: Next.js September 2026 Security Release