Next.js 16.4.5 security release: who must patch now

Next.js 16.4.5 and 15.5.29, the November 2026 security release, fix seven vulnerabilities, four of them in use cache and Cache Components. Both reached npm on 3 November 2026, at 18:01 and 18:36 UTC, and npm's latest tag is now 16.4.5. Run npm install next@16.4.5 on Next.js 16 or npm install next@15.5.29 on 15. That includes 16.4.4: the Next.js 16.4.4 bug-fix patch from the day before fixes none of these. 15.5.29 carries three of the fixes: response injection behind a proxy, the SVG bypass in image optimisation and the cookie header on Edge routes. The other four affect only 16.x apps with Cache Components or use cache. If you run Cache Components with root params, self-host with next start, set cookies in Edge routes or optimise remote images, patch today; we would also empty any cache that survives a deploy. We checked every claim below against the advisories, the GitHub releases, the npm registry and the Next.js blog on 4 November 2026. We did not reproduce any of the issues.

What changed in Next.js 16.4.5 and 15.5.29

The 16.4.5 release notes (opens in a new tab) list seven advisories. The 15.5.29 release notes (opens in a new tab) list three of them. In the comparison of 16.4.4 and 16.4.5 (opens in a new tab), the release is eight commits: one fix per advisory and the version bump, no other change. The 15.5.28 to 15.5.29 comparison (opens in a new tab) adds the three fixes to three commits that only touch Next.js's own release and CI pipeline. On the npm registry (opens in a new tab), both versions keep the third-party dependencies, the React peer range and the Node.js range of the patch before them (>=20.9.0 on 16.4.5). The only other change in your lockfile is @next/env, which is pinned to the exact next version and moves with it.

Every advisory carries a severity, a CVSS 4.0 score and a CVE ID on GitHub, read through GitHub's advisory API (opens in a new tab) on 4 November. The Next.js post (opens in a new tab) gives its own severity and no CVE:

A root param is a route parameter of the root layout, such as [locale] or [tenant] in app/[tenant]/layout.tsx, read with next/root-params. The advisories describe how a use cache entry should depend on every root param its function reads, on top of what makes two calls share an entry. Two of the four cache bugs drop that root param from the key, so an app that separates tenants, sites or locales by root param can serve one tenant's cached content to another.

Is the November release high or medium severity?

Both, depending on whom you read. The advance notice of 27 October (opens in a new tab) announced "seven medium vulnerabilities". The release post of 3 November calls the unstable_cache leak High and the other six Medium. The GitHub advisories and both release notes rate all seven Moderate. The scores sit close together: six advisories score between 6.0 and 6.3, and the SVG bypass scores 6.9, the highest, the only one whose CVSS vector lists no attack requirements (AT:N) alongside low complexity and no user interaction. Record the High rating if you track the unstable_cache leak, because a cross-tenant leak is a serious finding for a multi-tenant app whatever the score.

Who is affected by the Next.js November 2026 vulnerabilities

Every advisory needs a specific setup. Find yours in the left column; the conditions come from each advisory and the Next.js post.

The Next.js post narrows two of them. The Edge cookie leak did not reproduce in Node.js route handlers or with cookies().set(). It also needs attacker-controlled JavaScript already running on your origin, so it is not a way to run scripts. The response injection needs the pipelining proxy behaviour and does not apply to every reverse proxy. Three advisories (shell poisoning, response injection and the SVG bypass) describe self-hosted deployments only. Netlify's changelog entry on the Next.js vulnerabilities (opens in a new tab), updated on 4 November, lists four of the seven as affecting sites on Netlify and ships its adapter @netlify/plugin-nextjs 5.16.6 for the Middleware cookie case.

How to tell whether your app uses the affected patterns

From the project root, these checks find the setups in the table:

npx next --version                                      # below 16.4.5 or 15.5.29: upgrade
grep -rn "cacheComponents\|partialPrefetching" next.config.*
grep -rln "next/root-params" app src lib 2>/dev/null    # root params read in cached code
grep -rln "unstable_cache" app src lib 2>/dev/null      # combined with "use cache": GHSA-mfr8
grep -rln "runtime = \"edge\"" app src pages 2>/dev/null # Edge routes: look for cookies.set()

For the Edge cookie, request a route that sets a cookie and look for the internal header in the response. After the upgrade, the fix commit (opens in a new tab) strips it from Edge responses:

curl -s -D - -o /dev/null https://your-app.example/api/login | grep -i x-middleware-set-cookie

Which Next.js versions get a fix?

Only the two LTS lines. The Next.js support policy (opens in a new tab) puts 16.x in Active LTS and 15.x in Maintenance LTS with security releases until 31 January 2027, and 14.x and older are unsupported. On npm, no 16.2.x or 16.3.x release came out on 3 November: the newest are still 16.2.12 (25 July) and 16.3.8 (30 September).

• 16.0 to 16.4.4: upgrade to 16.4.5. There is no 16.2 or 16.3 backport, so a minor upgrade comes with the patch. Read the 16.4.4 release notes (opens in a new tab) and the 16.4 changes before you move.
• 15.0 to 15.5.28: upgrade to 15.5.29. The cache advisories don't affect 15.x.
• 14.x and older: the response injection advisory's version field reads >= 16.0.0 and < 16.0.0 together, which we read as every version, and the newest 14.x on npm is still 14.2.35, from December 2025. The other six list no version below 15.0.0. The advisory lists no workaround and 14.x gets no patch, so the way out is 15.5.29 or 16.4.5.

Read the advisories' own version fields with care. On 4 November most of them listed no patched version. The nested use cache advisory named 16.4.2, which the 16.4.5 release notes contradict, and three gave 16.4.2 as the last affected version, although 16.4.3 and 16.4.4 carry no security fix. None of the seven was in the global GitHub Advisory Database yet (its API answered 404 for each), and Dependabot alerts only on GitHub-reviewed advisories (opens in a new tab). So no Dependabot alert today doesn't mean you are patched. Go by the release notes: 16.4.5 and 15.5.29.

How to upgrade to Next.js 16.4.5 or 15.5.29

1. Find the version you run

   Run npx next --version or npm ls next. In a monorepo, check every app: each one that resolves to a version below 16.4.5 on 16.x, or below 15.5.29 on 15.x, needs the upgrade.

2. Install the patched version

   Run npm install next@16.4.5 on 16.x or npm install next@15.5.29 on 15.x (pnpm add and yarn add work the same). Node.js and the React peer range don't change, so react and react-dom stay as they are.

3. Check what the lockfile resolved

   Run npm ls next again and deploy from a clean install. A caret range like ^16.4.4 in package.json only takes 16.4.5 once the lockfile is updated.

4. Empty caches that outlive a deploy

   Entries written before the fix stay wrong after it: the unstable_cache leak keeps serving until the entry is revalidated or evicted, and a poisoned shell keeps its 404 across restarts. The advisories don't ask you to purge anything; our own advice is that if you use a shared cache handler or a persistent cache volume, you empty it after the upgrade. On Netlify, follow its changelog: purge branch deploys and Deploy Previews, which a production deploy doesn't clear.

5. Use the workarounds only while you can't upgrade

   The unstable_cache advisory says that not calling a use cache function inside unstable_cache is a complete workaround. The shell advisory's workaround is partialPrefetching: true in next.config. The other five list none, so upgrade as soon as you can.

What to watch out for

• 16.4.4 is not patched. It came out a day earlier and is a bug-fix release. Close a security ticket only on 16.4.5 or 15.5.29.
• The install comment says "16.5". In the Next.js post, the line npm install next@16.4.5 carries the comment # for 16.5. The command is right. 16.5 is still in canary (16.5.0-canary.40 on npm on 4 November), so don't go looking for a 16.5 release.
• The release post doesn't link the shell advisory. It describes the shared shell poisoning without a link. GHSA-vvgp-ww4w-46vf is in the 16.4.5 release notes.
• No exploitation reported. None of the sources mentions exploitation in the wild or a public proof of concept. With the advisories public since 3 November, that is no reason to wait.
• When we read each source. The Next.js posts, both GitHub releases, the seven advisories, the npm registry, the support policy and Netlify's changelog, all on 4 November 2026. We did not run 16.4.5 on a demo or reproduce any advisory.

Further reading