The Next.js team has disclosed seven security vulnerabilities in Next.js (one high, five medium, one low), patched on September 30, 2026 in 15.5.27 and 16.3.8. The issues span server-side request forgery (SSRF), cache poisoning, and information disclosure. Several of them do not affect apps hosted on Netlify. Here's what Netlify customers need to know. Summary Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in Impact on Netlify), so if you run Next.js on Netlify, we strongly recommend upgrading next to 15.5.27 or 16.3.8 and redeploying. The OpenNext Netlify Next.js adapter must also be updated to @netlify/plugin-nextjs 5.16.1; it's auto-installed by default, so a redeploy picks it up (a manual upgrade is only needed if you pin the version). See What should I do? for full steps. Vulnerabilities All issues are patched in 15.5.27 and 16.3.8. Vulnerability: GHSA-cjq9-62q9-8jv4 / CVE-2026-94483 — Image optimizer SSRF Severity: High Affected: 16.x with an attacker-controlled remote host in images.remotePatterns Vulnerability: GHSA-4jqv-mc3x-m676 / CVE-2026-94543 — Cache poisoning of SSG/ISR pages (cross-route) Severity: Medium Affected: 15.x/16.x Pages Router apps with SSG/ISR and a root catch-all route Vulnerability: GHSA-mcj8-r9mp-w47p / CVE-2026-94484 — Cache poisoning via encoded paths / /index (SSG/ISR) Severity: Medium Affected: 15.x/16.x apps combining a root catch-all with SSG/ISR routes Vulnerability: GHSA-f87g-xv8r-7p7x / CVE-2026-94485 — Metadata image dynamicParams bypass (information disclosure) Severity: Medium Affected: 16.x App Router Webpack builds using metadata image routes Vulnerability: GHSA-h694-7cp9-m8p3 — Cache leak across root param values in nested use cache Severity: Medium Affected: 16.3.x with Cache Components + nested use cache reading root params Vulnerability: GHSA-3w37-wq28-93x7 / CVE-2026-94544 — Draft Mode use cache content leak Severity: Medium Affected: 16.3.x with Cache Components / useCache, Draft Mode, and draft-dependent cached content Vulnerability: GHSA-39w2-rjm5-chcv / CVE-2026-94486 — Development MCP information disclosure Severity: Low Affected: 16.x development servers (next dev) with the MCP endpoint Impact on Netlify Not affected on Netlify
Continue reading...
- GHSA-cjq9-62q9-8jv4 (Image optimizer SSRF): Netlify projects are not affected. Image optimization on Netlify is handled by Netlify Image CDN — a separate service outside your project's functions — so the vulnerable Next.js image-optimizer code path is not used, and the Image CDN has its own protections against this class of SSRF.
- GHSA-3w37-wq28-93x7 (Draft Mode use cache content leak): Netlify projects are not affected. This leak requires two requests to share a single server process's in-flight cache fill. On Netlify's serverless architecture each request is served by its own isolated invocation, so the required overlap cannot occur.
- GHSA-39w2-rjm5-chcv (Development MCP information disclosure): Netlify projects are not affected. This affects the next dev development server only; Netlify serves production builds, which do not expose the development MCP endpoint.
- GHSA-4jqv-mc3x-m676 (cross-route cache poisoning): Pages Router apps with SSG/ISR and a root catch-all route are affected on Netlify. Upgrading Next.js resolves the poisoning on its own. The fix also changes how cache entries are keyed, so you should update the Netlify adapter (5.16.1) as well — otherwise prerendered pages miss the cache and re-render (a serving/performance regression, not a security one). See What should I do? .
- GHSA-mcj8-r9mp-w47p (encoded paths / /index): App Router apps with a prerendered catch-all route are affected by an availability issue — certain valid percent-encoded URLs can return an error (HTTP 500) instead of the page. Upgrading Next.js resolves it.
- GHSA-h694-7cp9-m8p3 (cache leak across root param values): affects Next.js 16.x apps using Cache Components with a nested use cache that reads root params (e.g. locale or region segments) — an enclosing cache entry can be keyed without the root param and reused across values, so content produced for one value can be served for another. Upgrading Next.js resolves it.
- Upgrade next to 15.5.27 or 16.3.8 and redeploy.
- Auto-installed adapter (default): redeploy — the update is applied automatically.
- Manually installed adapter: upgrade @netlify/plugin-nextjs to v5.16.1 and redeploy. We recommend not pinning the adapter version so future fixes ship automatically.
- Next.js September 2026 security release
- Next.js security advisories
Continue reading...