The Clearinghouse Log

Three Next.js Security Releases in Five Weeks: A Practical Patch-and-Stay-Current Guide

Between Aug 25 and Sep 30, 2026, Next.js shipped three security releases - two critical RCEs, an OG-image RCE via Satori, and a seven-advisory sweep. Here is what each fixed and how to stay current.

WW

Wesley Williams

Full-Stack Developer

Three Next.js Security Releases in Five Weeks: A Practical Patch-and-Stay-Current Guide

Between August 25 and September 30, 2026, Next.js shipped three security releases in five weeks. Two of them landed out-of-band because of critical remote code execution (RCE) vulnerabilities; the third was a scheduled seven-advisory sweep. That cadence is unusual for any framework, and it is directly relevant if you ship a Next.js app - this site, the SMF Clearinghouse, is one of them, deployed on Vercel.

This post breaks down what each release fixed, gives you the exact upgrade commands for Active LTS (16.3.x) versus Maintenance LTS (15.5.x), and ends with a concrete checklist for staying current. Everything below is sourced from the official Next.js blog and GitHub Security Advisories. I am not going to speculate about exploitation in the wild beyond what Vercel has published.

Why this matters for a Windows-native full-stack dev

One of the two critical vulnerabilities in the August release is Windows-filesystem-specific. If you run a self-hosted Next.js server on Windows - for local development, for an internal tool, or because your deployment target is a Windows box - that advisory applies to you in a way it does not apply to a Linux or macOS host. As someone who develops on Windows and ships cross-platform, I treat filesystem-path-handling CVEs as a signal to audit every Windows-hosted Next.js instance I am responsible for, not just the Linux production fleet.

Release 1 - August 25, 2026: 16.3.3 / 15.5.24 (two critical RCEs)

This was originally announced for August 26, but Vercel moved it forward a day after identifying a second critical vulnerability in an upstream dependency.

Critical: RCE in the Image Optimization API via AVIF (CVSS 9.5)

A vulnerability in libheif - the library that sharp uses under the hood - can lead to unauthenticated remote code execution when Next.js optimizes an attacker-controlled AVIF image. The Image Optimization API is a common feature: any route that serves optimized images (/_next/image?url=...) is a potential entry point if it processes user-supplied or remote AVIF files.

The patched releases disable AVIF optimization entirely until an upstream fix propagates through libheif. That is a behavioral change worth noting - if you relied on AVIF output from Image Optimization, you will fall back to other formats after upgrading.

Critical: RCE on Windows-hosted servers (CVSS 9.0)

This one is personal for a Windows-first developer. Applications that use both the Pages Router and the App Router without Cache Components can be exploited for unauthenticated RCE when the Next.js server runs on a Windows filesystem. Linux and macOS are not affected. Vercel advisory states plainly: there is no known workaround for affected Windows-hosted applications.

The affected range is broad: Next.js >=13.4 and <15.5.24, or >=16.0 and <16.3.3. If you have a hybrid Pages+App Router app self-hosted on Windows, this is not optional.

Upgrade:

npm install next@16.3.3   # Active LTS
npm install next@15.5.24   # Maintenance LTS (15.5)

Source: Next.js - August 2026 Security Release

Release 2 - September 22, 2026: 16.3.6 / 15.5.26 (OG image RCE via Satori)

One week after the August release, Vercel pushed an out-of-band release for another critical RCE - this time in the Open Graph image generator.

Critical: RCE in next/og ImageResponse (CVE-2026-94545)

The Node.js ImageResponse implementation in next/og had improper escaping in SVG output generated by Satori, the library that turns your JSX into an SVG before rasterizing it to a PNG for your OG card. Under specific conditions, that escaping flaw combined with vulnerabilities in other upstream dependencies to produce a remote code execution path.

Key scope details from the advisory:

  • Affected: Next.js 16.2.0 through 16.3.5 (the Node.js ImageResponse, not the Edge runtime implementation).
  • 15.x is not directly affected by the RCE - 15.5.26 ships related hardening only.
  • Edge runtime ImageResponse is not affected.
  • The upstream Satori advisory is GHSA-wx4j-mvgx-mqwp (CVSS 5.3, Moderate), patched in Satori 0.33.5.

Until you can patch, the guidance is simple: do not feed untrusted input into elements passed to ImageResponse. Escape it as XML before rendering, or keep it out of the generated image. A subtlety worth flagging: long-lived deploy previews and branch deploys can stay vulnerable until they are deleted, so clean up stale preview environments.

Upgrade:

npm install next@16.3.6   # Active LTS
npm install next@15.5.26   # Maintenance LTS (hardening)

Source: Next.js blog index and the advisory above.

Release 3 - September 30, 2026: 16.3.8 / 15.5.27 (one High, five Medium, one Low)

Eight days after the OG-image RCE, the scheduled September release landed with seven vulnerabilities: one High, five Medium, one Low. A fix for one critical and one high severity issue was postponed due to upstream dependency delays, which is why the final count is what it is.

High: SSRF in Image Optimization (CVE-2026-94483)

An attacker-controlled, allow-listed remote URL can force server-side requests to private IP ranges during Image Optimization. If you have images.remotePatterns configured (which most apps using remote images do), you are in scope; if you do not configure remote patterns, you are not affected.

Medium: Cache poisoning of SSG/ISR pages (self-hosted)

Self-hosted Pages Router apps using SSG or ISR can have a page cache entry replaced with content from a different route, serving wrong content to every visitor until revalidation. Vercel deployments are not affected - this is a self-hosting footprint.

Medium: Cross-user content substitution via cache poisoning

Root-level catch-all pages combined with SSG/ISR routes can have their shared response cache poisoned by a single unauthenticated crafted request - cross-user content substitution and persistent denial of service.

Medium: Information disclosure in App Router metadata image routes (webpack only)

In webpack-built App Router apps, metadata image routes like opengraph-image and twitter-image ignore the dynamicParams route segment option, letting an attacker request metadata image URLs for dynamic segments deliberately excluded via generateStaticParams(). Turbopack builds are not affected.

Medium: Draft Mode content leak via pending use cache fill

A pending use cache fill can leak Draft Mode content into regular responses and persisted pages.

Low: Dev server MCP endpoint information disclosure

The next dev server exposes a Model Context Protocol (MCP) endpoint that does not verify request origin, letting a malicious website read sensitive dev data - project location on disk, error-report source snippets, route inventory, dev logs. Only next dev is affected; production deployments do not serve this endpoint. As someone who wires MCP into tooling, I would call this a good reminder to be deliberate about which network surfaces your dev server exposes.

Upgrade:

npm install next@16.3.8   # Active LTS
npm install next@15.5.27   # Maintenance LTS

Source: Next.js - September 2026 Security Release

A note on the LTS clock

Next.js 15 is in Maintenance LTS and loses all official support on October 21, 2026. It still receives critical security patches until then, which is why 15.5.24 / 15.5.26 / 15.5.27 exist - but the window to plan a clean upgrade to Next.js 16 is now, not under audit pressure. Next.js 14 and earlier are already end-of-life and receive no patches. (Source: HeroDevs - Next.js EOL timeline.)

If you are still on 15.x, the codemod path is npx @next/codemod@latest upgrade latest. The real cost is not the version bump - it is the App Router migration if you are still on Pages Router, React 19 compatibility, and the breaking changes that Maintenance LTS ships as semver-minor releases.

What I did for this site

The SMF Clearinghouse runs on Next.js and deploys on Vercel. That puts us in a relatively good posture for several of these advisories:

  • The Windows-filesystem RCE does not apply to our Vercel deployment, but it would apply to any local Windows dev server running a hybrid Pages+App Router app - worth remembering when you self-host.
  • The self-hosted SSG/ISR cache poisoning advisories explicitly exclude Vercel deployments, so we are clear there.
  • The SSRF in Image Optimization only matters if images.remotePatterns is configured - worth auditing your next.config regardless.
  • The next/og RCE applies to the Node.js ImageResponse on 16.2.0-16.3.5. If you generate OG images with untrusted input, patch and escape.

The straightforward action for any Next.js app on Active LTS is to be on 16.3.8 as of this writing; on Maintenance LTS, 15.5.27. This site was on 16.2.9 as of the last package.json check - which is inside the affected range for the OG-image RCE, so bumping to 16.3.8 is on the list.

A staying-current checklist

Three releases in five weeks is a cadence that rewards a repeatable process over heroics. Here is the checklist I run:

  1. Subscribe to the source. Watch the Next.js blog and the vercel/next.js security advisories. The blog is where release posts land; GitHub is where the CVE/GHSA detail lives.
  2. Know your LTS line. Active LTS (16.3.x) or Maintenance LTS (15.5.x) - and know the EOL date. Next.js 15 EOLs October 21, 2026.
  3. Audit your exposure per advisory, not per release. Each advisory states affected versions, conditions, and whether there is a workaround. The Image Optimization AVIF RCE requires processing attacker-controlled AVIF; the SSRF requires remotePatterns; the Windows RCE requires a hybrid Pages+App Router on a Windows filesystem. Do not upgrade blindly - but do not use "I think I am not affected" as a reason to skip, either.
  4. Upgrade in the right order. Patch the criticals first (August RCEs, OG-image RCE), then the scheduled sweep. Each release supersedes the prior on its LTS line - 16.3.8 includes the 16.3.6 and 16.3.3 fixes.
  5. Clean up preview environments. Long-lived branch deploys and preview URLs stay vulnerable until deleted. Stale previews are a quiet attack surface.
  6. Escape untrusted input into ImageResponse. Until you are patched, do not pass raw user input into OG-image JSX. Escape as XML or keep it out.
  7. Verify the build. npx next build after every upgrade. The blog loader on this site, for example, silently filters posts with unknown author keys - a patch that changes loader behavior is exactly where you want a green build before you push.
  8. Push to main, watch the deploy. On Vercel, pushing to main triggers the deploy. Confirm the production URL returns 200 after the build completes.

Sources

Hero image is a placeholder pending ComfyUI generation.