--- title: "Next.js security release (Sept 2026): what to know" description: "Seven security vulnerabilities in Next.js have been disclosed: cache poisoning, SSRF, and information disclosure. Affected Netlify projects should upgrade." source: "https://www.netlify.com/changelog/2026-09-30-nextjs-react-security-vulnerabilities/" last_updated: "2026-09-30T22:35:42.000Z" --- The Next.js team has disclosed [seven security vulnerabilities](https://github.com/vercel/next.js/security) in Next.js (one high, five medium, one low), patched on September 30, 2026 in 15.5.27 and 16.3.8. The issues span server-side request forgery (SSRF), cache poisoning, and information disclosure. Several of them do not affect apps hosted on Netlify. Here’s what Netlify customers need to know. ## Summary Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in [Impact on Netlify](#impact-on-netlify)), so if you run Next.js on Netlify, **we strongly recommend upgrading `next` to 15.5.27 or 16.3.8** and redeploying. The OpenNext Netlify Next.js adapter must also be updated to `@netlify/plugin-nextjs` 5.16.1; it’s auto-installed by default, so a redeploy picks it up (a manual upgrade is only needed if you pin the version). See [What should I do?](#what-should-i-do) for full steps. ## Vulnerabilities All issues are patched in **15.5.27** and **16.3.8**. Vulnerability Severity Affected [GHSA-cjq9-62q9-8jv4](https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4) / [CVE-2026-94483](https://www.cve.org/CVERecord?id=CVE-2026-94483) — Image optimizer SSRF High 16.x with an attacker-controlled remote host in `images.remotePatterns` [GHSA-4jqv-mc3x-m676](https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676) / [CVE-2026-94543](https://www.cve.org/CVERecord?id=CVE-2026-94543) — Cache poisoning of SSG/ISR pages (cross-route) Medium 15.x/16.x Pages Router apps with SSG/ISR and a root catch-all route [GHSA-mcj8-r9mp-w47p](https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p) / [CVE-2026-94484](https://www.cve.org/CVERecord?id=CVE-2026-94484) — Cache poisoning via encoded paths / `/index` (SSG/ISR) Medium 15.x/16.x apps combining a root catch-all with SSG/ISR routes [GHSA-f87g-xv8r-7p7x](https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x) / [CVE-2026-94485](https://www.cve.org/CVERecord?id=CVE-2026-94485) — Metadata image `dynamicParams` bypass (information disclosure) Medium 16.x App Router **Webpack** builds using metadata image routes [GHSA-h694-7cp9-m8p3](https://github.com/vercel/next.js/security/advisories/GHSA-h694-7cp9-m8p3) — Cache leak across root param values in nested `use cache` Medium 16.3.x with Cache Components + nested `use cache` reading root params [GHSA-3w37-wq28-93x7](https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7) / [CVE-2026-94544](https://www.cve.org/CVERecord?id=CVE-2026-94544) — Draft Mode `use cache` content leak Medium 16.3.x with Cache Components / `useCache`, Draft Mode, and draft-dependent cached content [GHSA-39w2-rjm5-chcv](https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv) / [CVE-2026-94486](https://www.cve.org/CVERecord?id=CVE-2026-94486) — Development MCP information disclosure Low 16.x **development** servers (`next dev`) with the MCP endpoint ## Impact on Netlify ### Not affected on Netlify - [GHSA-cjq9-62q9-8jv4](https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4) (Image optimizer SSRF): Netlify projects are **not affected**. Image optimization on Netlify is handled by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/) — a separate service outside your project’s functions — so the vulnerable Next.js image-optimizer code path is not used, and the Image CDN has its own protections against this class of SSRF. - [GHSA-3w37-wq28-93x7](https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7) (Draft Mode `use cache` content leak): Netlify projects are **not affected**. This leak requires two requests to share a single server process’s in-flight cache fill. On Netlify’s serverless architecture each request is served by its own isolated invocation, so the required overlap cannot occur. - [GHSA-39w2-rjm5-chcv](https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv) (Development MCP information disclosure): Netlify projects are **not affected**. This affects the `next dev` development server only; Netlify serves production builds, which do not expose the development MCP endpoint. ### Information disclosure [GHSA-f87g-xv8r-7p7x](https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x) (Metadata image `dynamicParams` bypass) can expose content from routes excluded via `dynamicParams` through metadata image routes. It only affects **Webpack** builds; **Turbopack builds are not affected**. On Netlify, apps that use a Webpack build are **affected**; upgrading Next.js resolves it. ### Cache poisoning and availability [GHSA-4jqv-mc3x-m676](https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676) and [GHSA-mcj8-r9mp-w47p](https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p) affect apps with SSG/ISR routes behind a root catch-all. - [GHSA-4jqv-mc3x-m676](https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676) (cross-route cache poisoning): Pages Router apps with SSG/ISR and a root catch-all route are **affected** on Netlify. **Upgrading Next.js resolves the poisoning on its own.** The fix also changes how cache entries are keyed, so you should update the Netlify adapter (5.16.1) as well — otherwise prerendered pages miss the cache and re-render (a serving/performance regression, not a security one). See [What should I do?](#what-should-i-do). - [GHSA-mcj8-r9mp-w47p](https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p) (encoded paths / `/index`): App Router apps with a prerendered catch-all route are **affected** by an availability issue — certain valid percent-encoded URLs can return an error (HTTP 500) instead of the page. Upgrading Next.js resolves it. - [GHSA-h694-7cp9-m8p3](https://github.com/vercel/next.js/security/advisories/GHSA-h694-7cp9-m8p3) (cache leak across root param values): affects Next.js 16.x apps using Cache Components with a nested `use cache` that reads root params (e.g. locale or region segments) — an enclosing cache entry can be keyed without the root param and reused across values, so content produced for one value can be served for another. Upgrading Next.js resolves it. ## What should I do? We strongly recommend upgrading as soon as possible: - Upgrade `next` to **15.5.27** or **16.3.8** and redeploy. The OpenNext Netlify Next.js adapter that runs your app must also be updated to v5.16.1: - Auto-installed adapter (default): redeploy — the update is applied automatically. - Manually installed adapter: upgrade `@netlify/plugin-nextjs` to v5.16.1 and redeploy. We recommend [not pinning the adapter version](https://docs.netlify.com/build/frameworks/framework-setup-guides/nextjs/overview/#how-netlify-runs-your-nextjs-app) so future fixes ship automatically. Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui). ## Resources - [Next.js September 2026 security release](https://nextjs.org/blog/september-2026-security-release) - [Next.js security advisories](https://github.com/vercel/next.js/security)