---
title: "Next.js 16.4.5 security release: who must patch now"
description: "Next.js 16.4.5 and 15.5.29 (3 Nov 2026) fix seven advisories, four in use cache and Cache Components. Who is affected, which line is fixed and how to patch."
canonical_url: "https://www.outofplace.space/blog/nextjs-16-4-5-security-release"
language: "en"
last_updated: "2026-11-04"
alternates:
  pl: "https://www.outofplace.space/pl/blog/nextjs-16-4-5-aktualizacja-bezpieczenstwa.md"
---

# Next.js 16.4.5 security release: who must patch now

> Next.js 16.4.5 and 15.5.29 (3 Nov 2026) fix seven advisories, four in use cache and Cache Components. Who is affected, which line is fixed and how to patch.

Published 2026-11-04 · Category: Next.js & React · Tags: Next.js, Security, Caching

Next.js 16.4.5 and 15.5.29, the November 2026 security release, fix seven vulnerabilities, four of them in `use cache` and Cache Components. Both reached npm on 3 November 2026, at 18:01 and 18:36 UTC, and npm's `latest` tag is now 16.4.5. Run `npm install next@16.4.5` on Next.js 16 or `npm install next@15.5.29` on 15. That includes 16.4.4: the [Next.js 16.4.4 bug-fix patch](https://www.outofplace.space/blog/nextjs-16-4-4-release) from the day before fixes none of these. 15.5.29 carries three of the fixes: response injection behind a proxy, the SVG bypass in image optimisation and the cookie header on Edge routes. The other four affect only 16.x apps with Cache Components or `use cache`. If you run Cache Components with root params, self-host with `next start`, set cookies in Edge routes or optimise remote images, patch today; we would also empty any cache that survives a deploy. We checked every claim below against the advisories, the GitHub releases, the npm registry and the Next.js blog on 4 November 2026. We did not reproduce any of the issues.

  - Seven advisories, CVE-2026-119346 to CVE-2026-119351 and CVE-2026-119790, all published on GitHub on 3 November 2026.
  - The Next.js blog rates one High and six Medium; GitHub rates all seven Moderate, CVSS 4.0 between 6.0 and 6.9.
  - 16.4.5 contains exactly the seven fixes. 15.5.29 contains three fixes plus CI changes.
  - 16.2 and 16.3 get no backport: upgrade to 16.4.5. 14.x gets nothing.

## What changed in Next.js 16.4.5 and 15.5.29

The [16.4.5 release notes](https://github.com/vercel/next.js/releases/tag/v16.4.5) list seven advisories. The [15.5.29 release notes](https://github.com/vercel/next.js/releases/tag/v15.5.29) list three of them. In the [comparison of 16.4.4 and 16.4.5](https://github.com/vercel/next.js/compare/v16.4.4...v16.4.5), the release is eight commits: one fix per advisory and the version bump, no other change. The [15.5.28 to 15.5.29 comparison](https://github.com/vercel/next.js/compare/v15.5.28...v15.5.29) adds the three fixes to three commits that only touch Next.js's own release and CI pipeline. On the [npm registry](https://registry.npmjs.org/next), both versions keep the third-party dependencies, the React peer range and the Node.js range of the patch before them (`>=20.9.0` on 16.4.5). The only other change in your lockfile is `@next/env`, which is pinned to the exact `next` version and moves with it.

| Version | On npm (UTC)        | Line                       | dist-tag on 4 Nov | November fixes                                     |
| ------- | ------------------- | -------------------------- | ----------------- | -------------------------------------------------- |
| 16.4.4  | 2 Nov 2026, 10:49   | 16.x, Active LTS           | -                 | None                                               |
| 16.4.5  | 3 Nov 2026, 18:01   | 16.x, Active LTS           | `latest`          | All seven                                          |
| 15.5.28 | 14 Oct 2026, 17:36  | 15.x, Maintenance LTS      | -                 | None                                               |
| 15.5.29 | 3 Nov 2026, 18:36   | 15.x, Maintenance LTS      | `backport`        | Response injection, SVG bypass, Edge cookie header |

Every advisory carries a severity, a CVSS 4.0 score and a CVE ID on GitHub, read through [GitHub's advisory API](https://docs.github.com/en/rest/security-advisories/repository-advisories) on 4 November. The [Next.js post](https://nextjs.org/blog/november-2026-security-release) gives its own severity and no CVE:

| Advisory | What goes wrong | Next.js blog | GitHub (CVSS 4.0) | Fixed in |
| -------- | --------------- | ------------ | ----------------- | -------- |
| [GHSA-mfr8-8qww-v76h](https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h), CVE-2026-119790 | A `use cache` result for one root param value is served for others when the function is also called through `unstable_cache` | High | Moderate (6.3) | 16.4.5 |
| [GHSA-vc7v-qv4w-wrv8](https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8), CVE-2026-119351 | An outer `use cache` entry is stored without the root param an inner one read | Medium | Moderate (6.3) | 16.4.5 |
| [GHSA-vvgp-ww4w-46vf](https://github.com/vercel/next.js/security/advisories/GHSA-vvgp-ww4w-46vf), CVE-2026-119350 | One request can poison a fallback shell that a family of routes shares | Medium | Moderate (6.3) | 16.4.5 |
| [GHSA-rhh4-g77r-r9qj](https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj), CVE-2026-119349 | Different binary arguments to a `use cache` function get the same cache key | Medium | Moderate (6.3) | 16.4.5 |
| [GHSA-pc58-hwjq-p385](https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385), CVE-2026-119348 | A forwarded fetch response keeps compressed framing headers on a decompressed body | Medium | Moderate (6.3) | 16.4.5, 15.5.29 |
| [GHSA-7qx7-33qx-rqx2](https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2), CVE-2026-119347 | An SVG passed off as AVIF gets past `dangerouslyAllowSVG: false` | Medium | Moderate (6.9) | 16.4.5, 15.5.29 |
| [GHSA-f3mh-rxg3-f5g2](https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2), CVE-2026-119346 | A cookie set on an Edge route is copied into the `x-middleware-set-cookie` header, readable by same-origin JavaScript | Medium | Moderate (6.0) | 16.4.5, 15.5.29 |

A root param is a route parameter of the root layout, such as `[locale]` or `[tenant]` in `app/[tenant]/layout.tsx`, read with `next/root-params`. The advisories describe how a `use cache` entry should depend on every root param its function reads, on top of [what makes two calls share an entry](https://www.outofplace.space/blog/nextjs-use-cache#how-use-cache-works-what-makes-two-calls-share-an-entry). Two of the four cache bugs drop that root param from the key, so an app that separates tenants, sites or locales by root param can serve one tenant's cached content to another.

## Is the November release high or medium severity?

Both, depending on whom you read. The [advance notice of 27 October](https://nextjs.org/blog/upcoming-nextjs-security-release-november-2026) announced "seven medium vulnerabilities". The release post of 3 November calls the `unstable_cache` leak High and the other six Medium. The GitHub advisories and both release notes rate all seven Moderate. The scores sit close together: six advisories score between 6.0 and 6.3, and the SVG bypass scores 6.9, the highest, the only one whose CVSS vector lists no attack requirements (`AT:N`) alongside low complexity and no user interaction. Record the High rating if you track the `unstable_cache` leak, because a cross-tenant leak is a serious finding for a multi-tenant app whatever the score.

## Who is affected by the Next.js November 2026 vulnerabilities

Every advisory needs a specific setup. Find yours in the left column; the conditions come from each advisory and the Next.js post.

| You are affected if | Advisory | Lines |
| ------------------- | -------- | ----- |
| Cache Components is on and one public `use cache` function that reads a root param is called both directly and inside `unstable_cache`, and the `unstable_cache` call arrives while the function's first fill after a process start is still in flight (outside that race, the nesting throws an error) | GHSA-mfr8 | 16.x from 16.3.0 |
| An inner `use cache` function reads a root param and returns ready data alongside a still-pending promise, and the outer `use cache` function finishes without awaiting it | GHSA-vc7v | 16.x from 16.2.0 |
| You self-host with `next start`, `cacheComponents: true` and `partialPrefetching` unset or `false`, and a dynamic route has a blocking fallback shell with the route shape the advisory describes | GHSA-vvgp | 16.x from 16.4.0 |
| A `use cache` function takes binary arguments (`Uint8Array`, `Blob`) that tell users or accounts apart | GHSA-rhh4 | 16.x |
| You self-host, a route handler or the fetch cache returns a fetched upstream `Response` unchanged, and an HTTP/1.1 reverse proxy queues pipelined requests on a shared backend connection | GHSA-pc58 | 16.x, 15.x and older |
| You self-host the image optimiser (`/_next/image`), keep `images.dangerouslyAllowSVG` at its default `false`, optimise images from a permitted source an attacker can control, and use a native backend that can decode SVG | GHSA-7qx7 | 16.x, 15.x |
| An App Router Edge route handler or a Pages Router Edge API route sets a cookie with `NextResponse.cookies.set()` | GHSA-f3mh | 16.x, 15.x |

The Next.js post narrows two of them. The Edge cookie leak did not reproduce in Node.js route handlers or with `cookies().set()`. It also needs attacker-controlled JavaScript already running on your origin, so it is not a way to run scripts. The response injection needs the pipelining proxy behaviour and does not apply to every reverse proxy. Three advisories (shell poisoning, response injection and the SVG bypass) describe self-hosted deployments only. [Netlify's changelog entry on the Next.js vulnerabilities](https://www.netlify.com/changelog/2026-11-03-nextjs-security-vulnerabilities/), updated on 4 November, lists four of the seven as affecting sites on Netlify and ships its adapter `@netlify/plugin-nextjs` 5.16.6 for the Middleware cookie case.

### How to tell whether your app uses the affected patterns

From the project root, these checks find the setups in the table:

```bash
npx next --version                                      # below 16.4.5 or 15.5.29: upgrade
grep -rn "cacheComponents\|partialPrefetching" next.config.*
grep -rln "next/root-params" app src lib 2>/dev/null    # root params read in cached code
grep -rln "unstable_cache" app src lib 2>/dev/null      # combined with "use cache": GHSA-mfr8
grep -rln "runtime = \"edge\"" app src pages 2>/dev/null # Edge routes: look for cookies.set()
```

For the Edge cookie, request a route that sets a cookie and look for the internal header in the response. After the upgrade, the [fix commit](https://github.com/vercel/next.js/commit/809be725f) strips it from Edge responses:

```bash
curl -s -D - -o /dev/null https://your-app.example/api/login | grep -i x-middleware-set-cookie
```

## Which Next.js versions get a fix?

Only the two LTS lines. The [Next.js support policy](https://nextjs.org/support-policy) puts 16.x in Active LTS and 15.x in Maintenance LTS with security releases until 31 January 2027, and 14.x and older are unsupported. On npm, no 16.2.x or 16.3.x release came out on 3 November: the newest are still 16.2.12 (25 July) and 16.3.8 (30 September).

- **16.0 to 16.4.4:** upgrade to 16.4.5. There is no 16.2 or 16.3 backport, so a minor upgrade comes with the patch. Read the [16.4.4 release notes](https://github.com/vercel/next.js/releases/tag/v16.4.4) and the 16.4 changes before you move.
- **15.0 to 15.5.28:** upgrade to 15.5.29. The cache advisories don't affect 15.x.
- **14.x and older:** the response injection advisory's version field reads `>= 16.0.0` and `< 16.0.0` together, which we read as every version, and the newest 14.x on npm is still 14.2.35, from December 2025. The other six list no version below 15.0.0. The advisory lists no workaround and 14.x gets no patch, so the way out is 15.5.29 or 16.4.5.

Read the advisories' own version fields with care. On 4 November most of them listed no patched version. The nested `use cache` advisory named 16.4.2, which the 16.4.5 release notes contradict, and three gave 16.4.2 as the last affected version, although 16.4.3 and 16.4.4 carry no security fix. None of the seven was in the global GitHub Advisory Database yet (its API answered 404 for each), and [Dependabot alerts only on GitHub-reviewed advisories](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database). So no Dependabot alert today doesn't mean you are patched. Go by the release notes: 16.4.5 and 15.5.29.

## How to upgrade to Next.js 16.4.5 or 15.5.29

**1. Find the version you run.**
    Run `npx next --version` or `npm ls next`. In a monorepo, check every app: each one that resolves to a version below 16.4.5 on 16.x, or below 15.5.29 on 15.x, needs the upgrade.

**2. Install the patched version.**
    Run `npm install next@16.4.5` on 16.x or `npm install next@15.5.29` on 15.x (`pnpm add` and `yarn add` work the same). Node.js and the React peer range don't change, so `react` and `react-dom` stay as they are.

**3. Check what the lockfile resolved.**
    Run `npm ls next` again and deploy from a clean install. A caret range like `^16.4.4` in `package.json` only takes 16.4.5 once the lockfile is updated.

**4. Empty caches that outlive a deploy.**
    Entries written before the fix stay wrong after it: the `unstable_cache` leak keeps serving until the entry is revalidated or evicted, and a poisoned shell keeps its 404 across restarts. The advisories don't ask you to purge anything; our own advice is that if you use a shared cache handler or a persistent cache volume, you empty it after the upgrade. On Netlify, follow its changelog: purge branch deploys and Deploy Previews, which a production deploy doesn't clear.

**5. Use the workarounds only while you can't upgrade.**
    The `unstable_cache` advisory says that not calling a `use cache` function inside `unstable_cache` is a complete workaround. The shell advisory's workaround is `partialPrefetching: true` in `next.config`. The other five list none, so upgrade as soon as you can.

## What to watch out for

- **16.4.4 is not patched.** It came out a day earlier and is a bug-fix release. Close a security ticket only on 16.4.5 or 15.5.29.
- **The install comment says "16.5".** In the Next.js post, the line `npm install next@16.4.5` carries the comment `# for 16.5`. The command is right. 16.5 is still in canary (`16.5.0-canary.40` on npm on 4 November), so don't go looking for a 16.5 release.
- **The release post doesn't link the shell advisory.** It describes the shared shell poisoning without a link. GHSA-vvgp-ww4w-46vf is in the 16.4.5 release notes.
- **No exploitation reported.** None of the sources mentions exploitation in the wild or a public proof of concept. With the advisories public since 3 November, that is no reason to wait.
- **When we read each source.** The Next.js posts, both GitHub releases, the seven advisories, the npm registry, the support policy and Netlify's changelog, all on 4 November 2026. We did not run 16.4.5 on a demo or reproduce any advisory.

## Further reading

- [November 2026 Security Release](https://nextjs.org/blog/november-2026-security-release): The Next.js post of 3 November 2026: the seven issues, their severity and the install commands.

- [Next.js v16.4.5 release](https://github.com/vercel/next.js/releases/tag/v16.4.5): The release notes with all seven advisories, each linked.

- [Next.js v15.5.29 release](https://github.com/vercel/next.js/releases/tag/v15.5.29): The Maintenance LTS release with the three advisories that apply to 15.x.

- [Next.js security advisories](https://github.com/vercel/next.js/security/advisories): Each advisory with its conditions, CVSS score, CVE and workaround, where one exists.

- [next on the npm registry](https://registry.npmjs.org/next): Every version with its publish time, dependencies and dist-tags.

- [Next.js support policy](https://nextjs.org/support-policy): Which major versions get security releases, and until when.

- [Dev digest: React and Next.js RCE fixes, Opus 5.5 fast mode](https://www.outofplace.space/blog/dev-digest-2026-10-18): Next.js news for 11 to 18 Oct 2026: patch React and Next.js for three critical RCEs, fast mode for Claude Opus 5.5 leaves preview and Python on Vercel goes GA.