--- title: "Next.js security release (Nov 2026): what to know" description: "Seven Next.js vulnerabilities disclosed: cache leaks, cookie exposure, and cache poisoning. Some affect Netlify. Affected projects should upgrade." source: "https://www.netlify.com/changelog/2026-11-03-nextjs-security-vulnerabilities/" last_updated: "2026-11-05T06:01:59.000Z" --- The Next.js team has disclosed [seven security vulnerabilities](https://github.com/vercel/next.js/security) in Next.js, patched on November 3, 2026 in **16.4.5** and **15.5.29**. The issues span cached data leaking between users, exposure of HttpOnly cookies, cache poisoning, and cross-client response injection. Several of them do not affect apps hosted on Netlify. Here’s what Netlify customers need to know. ## Summary Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in [Impact on Netlify](#impact-on-netlify)), so if you run Next.js on Netlify, **we strongly recommend upgrading `next` to 16.4.5 (or 15.5.29 on 15.x)** and redeploying. One issue also needs an update to the OpenNext Netlify Next.js adapter, `@netlify/plugin-nextjs` 5.16.6. The adapter is auto-installed by default, so a redeploy picks it up. You only need to upgrade it manually if you pin its version. See [What should I do?](#what-should-i-do) for full steps. ## Vulnerabilities Vulnerability CVE Severity Affected [GHSA-vc7v-qv4w-wrv8](https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8) — Cache leak across root param values in nested `'use cache'` functions via delayed inner stream metadata CVE-2026-119351 Medium 16.2+ apps using Cache Components with nested `use cache` functions and root params [GHSA-7qx7-33qx-rqx2](https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2) — SVG rejection bypass in Next.js image optimization CVE-2026-119347 Medium 15.x/16.x apps using the built-in image optimizer with `images.dangerouslyAllowSVG: false` [GHSA-vvgp-ww4w-46vf](https://github.com/vercel/next.js/security/advisories/GHSA-vvgp-ww4w-46vf) — Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params CVE-2026-119350 Medium 16.4+ apps using Cache Components with certain dynamic route shapes [GHSA-mfr8-8qww-v76h](https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h) — Information disclosure across root params in Next.js when a `'use cache'` function is called through `unstable_cache()` CVE-2026-119790 Medium 16.3+ apps using Cache Components that call the same `use cache` function directly and through `unstable_cache` [GHSA-f3mh-rxg3-f5g2](https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2) — HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes CVE-2026-119346 Medium Edge Route Handlers and Edge API routes that set HttpOnly cookies [GHSA-rhh4-g77r-r9qj](https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj) — Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments CVE-2026-119349 Medium 16.x apps passing binary arguments (e.g. `Blob`) to a shared `use cache` function [GHSA-pc58-hwjq-p385](https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385) — Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses CVE-2026-119348 Medium Self-hosted App Router routes returning a fetched response unchanged, behind certain reverse proxies ## Impact on Netlify ### Not affected on Netlify - [GHSA-7qx7-33qx-rqx2](https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2) (SVG rejection bypass): Netlify projects are **not affected**. Image optimization on Netlify is handled by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/), so the vulnerable Next.js image optimizer code is not used. Netlify Image CDN serves SVG images with a Content Security Policy that prevents scripts from running. - [GHSA-mfr8-8qww-v76h](https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h) (`use cache` leak via `unstable_cache`): Netlify projects are **not affected**. This leak requires two requests to share a single server process’s in-progress cache fill. On Netlify’s serverless architecture each request is served by its own isolated invocation, so the required overlap cannot occur. - [GHSA-pc58-hwjq-p385](https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385) (cross-client response injection): Netlify projects are **not affected**. Netlify’s infrastructure frames responses itself, so a response with an incorrect length from your app cannot affect responses to other requests. However, on unpatched versions, a Route Handler that returns a fetched response unchanged can send a response that browsers fail to decode. Upgrading Next.js resolves it. ### Information disclosure - [GHSA-vc7v-qv4w-wrv8](https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8) (nested `use cache` leak) and [GHSA-rhh4-g77r-r9qj](https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj) (binary `use cache` arguments): under the conditions in each advisory, content cached for one user or root param value (e.g. a locale or tenant) can be served to another. On Netlify, apps that meet those conditions are **affected**. Upgrading Next.js resolves both. - [GHSA-f3mh-rxg3-f5g2](https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2) (HttpOnly cookies in Edge responses): exploitation requires an attacker to already be able to run JavaScript on your site’s origin. It can then read cookies marked HttpOnly. On Netlify, this affects Edge Route Handlers and Edge API routes, and also **cookies set in Next.js Middleware**. The Netlify adapter update alone covers all of these. Upgrading Next.js fixes Edge Route Handlers and Edge API routes. **The Middleware case is fixed in the Netlify adapter**, so you also need adapter 5.16.6. See [What should I do?](#what-should-i-do). ### Cache poisoning and availability [GHSA-vvgp-ww4w-46vf](https://github.com/vercel/next.js/security/advisories/GHSA-vvgp-ww4w-46vf) (cache poisoning of shared fallback shells): affects Next.js 16.4+ apps using Cache Components with the route shape described in the advisory. A single request can cause valid pages to return a cached 404 error. On Netlify, apps that meet those conditions are **affected**. Upgrading Next.js resolves it. ## What should I do? We strongly recommend upgrading as soon as possible: - Upgrade `next` to **16.4.5** (or **15.5.29** if you’re on 15.x) and redeploy. The OpenNext Netlify Next.js adapter that runs your app must also be updated to v5.16.6: - Auto-installed adapter (default): redeploy — the update is applied automatically. - Manually installed adapter: upgrade `@netlify/plugin-nextjs` to v5.16.6 and redeploy. **Upgrading Next.js alone does not fix the Middleware case on Netlify.** We recommend [not pinning the adapter version](https://docs.netlify.com/build/frameworks/framework-setup-guides/nextjs/overview/#how-netlify-runs-your-nextjs-app) so future fixes ship automatically. A new deploy clears content cached by previous deploys **in the same deploy context**, including any entries affected by these issues. A production deploy does not clear the cache for branch deploys or Deploy Previews (and vice-versa). Purge affected entries in those contexts separately, [purge the whole site](https://docs.netlify.com/build/caching/caching-overview/#purge-by-site) or [delete those deploys](https://www.netlify.com/blog/deploy-deletion/). If you’ve [opted responses out of automatic invalidation](https://docs.netlify.com/build/caching/caching-overview/#opt-out-of-automatic-invalidation) with the `Netlify-Cache-ID` header, those stay cached after a deploy, so [purge them on demand](https://docs.netlify.com/build/caching/caching-overview/#on-demand-invalidation). Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui). ## Resources - [Next.js November 2026 security release](https://nextjs.org/blog/november-2026-security-release) - [Next.js security advisories](https://github.com/vercel/next.js/security)