Next.js 16.3.8 and 15.5.27 fix seven vulnerabilities, led by an SSRF in image optimization

The release was announced a week ahead, on September 23, and it arrived on schedule. What changed between the notice and the patch is the count: nine advisories were planned and seven shipped. The two that did not, rated critical and high, are waiting on an upstream dependency and will come in a later release. You upgrade with npm install next@16.3.8 on the 16.x line or npm install next@15.5.27 on the 15.x line.

The high severity one: SSRF through image optimization

CVE-2026-94483 affects the image optimizer. A remote URL that matches one of your allow-listed patterns but is under an attacker's control can make the server fetch other addresses, including private IP ranges. The condition is narrow: if you have not configured images.remotePatterns, your application is not affected.

The fix is in both release lines. Whether your allow-list can be abused depends on how broad its patterns are, so a wildcard host in that list deserves its own review.

Five medium: caches that serve the wrong page

Three of the five medium advisories are about caches. CVE-2026-94543 hits self-hosted Pages Router applications with statically generated or incrementally regenerated pages. A page's cache entry can be replaced with content from a different route, and every visitor sees the wrong page until the entry is revalidated. Applications deployed on Vercel are not affected.

CVE-2026-94484 needs a root-level catch-all page combined with static or ISR routes. One unauthenticated crafted request can poison the shared response cache. Next.js describes the result as cross-user content substitution and persistent denial of service.

Two advisories concern Cache Components. In GHSA-h694-7cp9-m8p3, a 'use cache' function calls another one that reads a root param, and the outer cache key omits that param. Content produced for one value is then served for another, though the leaked values cannot be chosen by an attacker. In CVE-2026-94544, a pending cache fill is shared between a Draft Mode request and a regular one. An ordinary visitor can receive unpublished content, and if that request prerenders the page, the draft content persists until revalidation.

The fifth, CVE-2026-94485, is an information disclosure in App Router applications built with webpack. Metadata image routes such as opengraph-image ignore the dynamicParams option, so an attacker can request images for dynamic segments you excluded from generateStaticParams(). Builds with Turbopack are not affected.

The low one lives in next dev

CVE-2026-94486 exists in the development server only. next dev exposes a Model Context Protocol (MCP) endpoint that does not check which website a request came from. A malicious page open in your browser while the dev server runs can read the project's location on disk, source snippets from error reports, the route inventory, and development logs. Production deployments do not serve the endpoint.

Low severity is the right label for a bug that needs a developer to visit a hostile page. It is also the one item on this list that reaches the machine you work on rather than a server, which is why the upgrade belongs on laptops too.

What is still open

The September 23 notice was updated on September 30 with a note on the remaining two advisories, one critical and one high. They are pending upstream coordination and will be addressed in a later Next.js release. No date is given. On npm, 16.3.8 carries the latest tag and 15.5.27 the backport tag; both were published on September 30.

• Upgrade: npm install next@16.3.8 on 16.x, npm install next@15.5.27 on 15.x.
• Self-hosted Pages Router with SSG or ISR: CVE-2026-94543 applies to you and not to Vercel deployments.
• Cache Components or experimental.useCache with Draft Mode previews: CVE-2026-94544 applies.
• Webpack builds with metadata image routes: CVE-2026-94485 applies; Turbopack builds are exempt.