Next.js 16.4.5 and 15.5.29 fix seven vulnerabilities, most of them in caching

Next.js shipped versions 16.4.5 and 15.5.29 on November 3, 2026, to fix seven vulnerabilities in the framework itself. The most serious one, rated high, can let an app built for several customers, or tenants, serve one tenant's cached data to another. Three more medium-severity flaws also live in the cache. The team announced the release on October 27, 2026, describing seven medium-severity issues; the final advisory rates one of them high. The fix is an upgrade: npm install next@16.4.5 on the 16 line and npm install next@15.5.29 on the 15 line.

Four flaws let the cache serve the wrong data

All four involve Cache Components, the feature that lets a developer mark a function with 'use cache' so its result is stored and reused. Many multi-tenant apps separate customers with a root parameter, such as a tenant ID in the URL, and the cache is supposed to keep those results apart.

The high-severity flaw, GHSA-mfr8-8qww-v76h, appears when the same public use cache function reads a root parameter and is called both directly and from inside unstable_cache. While the cache is filling for the first time, a concurrent call can receive another request's result. That result is then stored and served to later callers until it is revalidated or evicted, so it can contain another tenant's data.

GHSA-vc7v-qv4w-wrv8 affects nested cached functions, where the outer entry can be saved before the inner function records which root parameter it depends on. GHSA-rhh4-g77r-r9qj affects binary arguments: two different values can produce the same cache key, so one user can receive another user's cached result. Next.js says neither flaw lets an attacker inject arbitrary content or read unrelated cache entries.

The fourth applies to self-hosted apps started with next start that use Cache Components with Partial Prefetching off or unset. A crafted, unauthenticated request can poison a page shell shared by other URLs, which leads to wrong server-rendered content or persistent 404 responses. The advisory lists no GHSA identifier for this one, and setups with Partial Prefetching enabled were not affected in the reported tests.

Cookies, proxies, and images

GHSA-f3mh-rxg3-f5g2 affects Edge Route Handlers and Edge API routes that set cookies with NextResponse.cookies.set(). The cookie can leak into an internal x-middleware-set-cookie header, which JavaScript on the same origin can read even when the cookie is marked HttpOnly. Exploiting it requires attacker-controlled JavaScript already running on that origin. Node.js Route Handlers and cookies().set() were not affected in the reproduction.

GHSA-pc58-hwjq-p385 affects self-hosted apps that return a fetched Response controlled by an attacker without changing it. Behind an HTTP/1.1 reverse proxy that queues several clients' requests on one shared backend connection, responses can be delivered to the wrong client. Next.js says this depends on that specific proxy behavior, not on every reverse proxy.

GHSA-7qx7-33qx-rqx2 lets an image from an allowed source pass as AVIF and get past images.dangerouslyAllowSVG: false, so the server decodes it as SVG anyway. The allowlist of image sources still applies, and the flaw needs a native image backend that can decode SVG. Next.js says the finding does not itself show cross-site scripting or remote code execution.

What to install

The fixes ship in 16.4.5 and 15.5.29. The blog post does not list the range of affected versions, and it does not say whether apps hosted on Vercel are protected at the platform level.

• On the 16 line, install 16.4.5.
• On the 15 line, install 15.5.29.