The Next.js team has disclosed seven security vulnerabilities in Next.js, patched on November 3, 2026 in 16.4.5 and 15.5.29. The issues span cached data leaking between users, exposure of HttpOnly cookies, cache poisoning, and cross-client response injection. Several of them do not affect apps hosted on Netlify. Here’s what Netlify customers need to know.

Summary

Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in Impact on Netlify), so if you run Next.js on Netlify, we strongly recommend upgrading next to 16.4.5 (or 15.5.29 on 15.x) and redeploying. One issue also needs an update to the OpenNext Netlify Next.js adapter, @netlify/plugin-nextjs 5.16.6. The adapter is auto-installed by default, so a redeploy picks it up. You only need to upgrade it manually if you pin its version. See What should I do? for full steps.

Vulnerabilities

Vulnerability	CVE	Severity	Affected
GHSA-vc7v-qv4w-wrv8 — Cache leak across root param values in nested `'use cache'` functions via delayed inner stream metadata	CVE-2026-119351	Medium	16.2+ apps using Cache Components with nested `use cache` functions and root params
GHSA-7qx7-33qx-rqx2 — SVG rejection bypass in Next.js image optimization	CVE-2026-119347	Medium	15.x/16.x apps using the built-in image optimizer with `images.dangerouslyAllowSVG: false`
GHSA-vvgp-ww4w-46vf — Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params	CVE-2026-119350	Medium	16.4+ apps using Cache Components with certain dynamic route shapes
GHSA-mfr8-8qww-v76h — Information disclosure across root params in Next.js when a `'use cache'` function is called through `unstable_cache()`	CVE-2026-119790	Medium	16.3+ apps using Cache Components that call the same `use cache` function directly and through `unstable_cache`
GHSA-f3mh-rxg3-f5g2 — HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes	CVE-2026-119346	Medium	Edge Route Handlers and Edge API routes that set HttpOnly cookies
GHSA-rhh4-g77r-r9qj — Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments	CVE-2026-119349	Medium	16.x apps passing binary arguments (e.g. `Blob`) to a shared `use cache` function
GHSA-pc58-hwjq-p385 — Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses	CVE-2026-119348	Medium	Self-hosted App Router routes returning a fetched response unchanged, behind certain reverse proxies

Impact on Netlify

Not affected on Netlify

GHSA-7qx7-33qx-rqx2 (SVG rejection bypass): Netlify projects are not affected. Image optimization on Netlify is handled by Netlify Image CDN, so the vulnerable Next.js image optimizer code is not used. Netlify Image CDN serves SVG images with a Content Security Policy that prevents scripts from running.
GHSA-mfr8-8qww-v76h (use cache leak via unstable_cache): Netlify projects are not affected. This leak requires two requests to share a single server process’s in-progress cache fill. On Netlify’s serverless architecture each request is served by its own isolated invocation, so the required overlap cannot occur.
GHSA-pc58-hwjq-p385 (cross-client response injection): Netlify projects are not affected. Netlify’s infrastructure frames responses itself, so a response with an incorrect length from your app cannot affect responses to other requests. However, on unpatched versions, a Route Handler that returns a fetched response unchanged can send a response that browsers fail to decode. Upgrading Next.js resolves it.

Information disclosure

GHSA-vc7v-qv4w-wrv8 (nested use cache leak) and GHSA-rhh4-g77r-r9qj (binary use cache arguments): under the conditions in each advisory, content cached for one user or root param value (e.g. a locale or tenant) can be served to another. On Netlify, apps that meet those conditions are affected. Upgrading Next.js resolves both.
GHSA-f3mh-rxg3-f5g2 (HttpOnly cookies in Edge responses): exploitation requires an attacker to already be able to run JavaScript on your site’s origin. It can then read cookies marked HttpOnly. On Netlify, this affects Edge Route Handlers and Edge API routes, and also cookies set in Next.js Middleware. The Netlify adapter update alone covers all of these. Upgrading Next.js fixes Edge Route Handlers and Edge API routes. The Middleware case is fixed in the Netlify adapter, so you also need adapter 5.16.6. See What should I do?.

Cache poisoning and availability

GHSA-vvgp-ww4w-46vf (cache poisoning of shared fallback shells): affects Next.js 16.4+ apps using Cache Components with the route shape described in the advisory. A single request can cause valid pages to return a cached 404 error. On Netlify, apps that meet those conditions are affected. Upgrading Next.js resolves it.

What should I do?

We strongly recommend upgrading as soon as possible:

Upgrade next to 16.4.5 (or 15.5.29 if you’re on 15.x) and redeploy.

The OpenNext Netlify Next.js adapter that runs your app must also be updated to v5.16.6:

Auto-installed adapter (default): redeploy — the update is applied automatically.
Manually installed adapter: upgrade @netlify/plugin-nextjs to v5.16.6 and redeploy. Upgrading Next.js alone does not fix the Middleware case on Netlify. We recommend not pinning the adapter version so future fixes ship automatically.

A new deploy clears content cached by previous deploys in the same deploy context, including any entries affected by these issues. A production deploy does not clear the cache for branch deploys or Deploy Previews (and vice-versa). Purge affected entries in those contexts separately, purge the whole site or delete those deploys. If you’ve opted responses out of automatic invalidation with the Netlify-Cache-ID header, those stay cached after a deploy, so purge them on demand.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.

Security Update: Multiple vulnerabilities in Next.js (November 2026)