Next.js 16.4.5 Security Release: What's Fixed and How to Patch (November 2026)

On November 3, 2026, Vercel released Next.js 16.4.5 (Active LTS) and Next.js 15.5.29 (Maintenance LTS) to fix seven security issues: one rated High and six rated Medium. This guide covers the official November 2026 security release, explains who is affected, and shows how to patch.

How do I patch Next.js?#

Upgrade to the fixed version for your release line:

npm install next@16.4.5   # 16.4 line (Active LTS)
npm install next@15.5.29  # 15.5 line (Maintenance LTS)

pnpm add next@16.4.5  # 16.4 line (Active LTS)
pnpm add next@15.5.29  # 15.5 line (Maintenance LTS)

yarn add next@16.4.5  # 16.4 line (Active LTS)
yarn add next@15.5.29  # 15.5 line (Maintenance LTS)

bun add next@16.4.5  # 16.4 line (Active LTS)
bun add next@15.5.29  # 15.5 line (Maintenance LTS)

The same works with pnpm add or yarn add. Then rebuild and redeploy. If you self-host with Docker, rebuild the image without cache so the new version is installed, as in my Next.js Dockerfile guide.

The advisory lists fixes for those two lines only. If you are on another version, check the linked GitHub advisories for your version, or move to a supported line.

What was fixed in the November 2026 release?#

The High issue: cross-tenant cache disclosure#

If an app has Cache Components enabled and calls the same public use cache function both directly and from inside unstable_cache, content can leak across root-parameter values. The cached function must read a root parameter, such as a tenant identifier.

During a cold cache fill, a concurrent call through unstable_cache can receive another request's result without its root parameters being checked. That result can be stored and then served to later callers until the entry is revalidated or evicted. Where root parameters separate tenants, the result can contain another tenant's data.

The Medium issues in the cache layer#

• Nested use cache. An outer cached function can be stored before the inner function's root-parameter dependencies are recorded, when the inner function returns an early value alongside a slower asynchronous one. Tenant-, site- or locale-specific content can then be served across the routing boundary.
• Binary arguments. Distinct binary arguments passed to a use cache function can produce the same cache identity. If you use them to tell users or accounts apart, one caller can receive another's cached result.
• Shared shell poisoning. Self-hosted apps running next start with Cache Components on and Partial Prefetching off or unset can have a shared page shell poisoned by an unauthenticated request, giving wrong content or persistent 404s. The affected route shape is narrow and described in the advisory.

The Medium issues outside the cache layer#

• Compressed response framing. A self-hosted app that returns an attacker-controlled fetched Response unchanged can forward decompressed bytes with the original compressed framing headers. Behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection, responses can be assigned to the wrong clients. It does not apply to every proxy setup.
• Edge cookie header. NextResponse.cookies.set() in Edge route handlers can expose the serialized cookie in x-middleware-set-cookie, which same-origin JavaScript can read even for HttpOnly cookies. It needs attacker-controlled script on your origin. Node.js route handlers and cookies().set() were not affected in the reproduced case.
• SVG bypass. A crafted image from a permitted source can be misclassified as AVIF and slip past images.dangerouslyAllowSVG: false. Your image-source allowlist still applies, and the advisory says this alone does not demonstrate XSS or remote code execution.

Am I affected? A quick checklist#

1. Do you use Cache Components? Look for cacheComponents in next.config and "use cache" directives. If neither exists, the four cache-layer issues do not apply to you.
2. Do you mix unstable_cache and use cache? Search for unstable_cache( wrapping a function that is also marked use cache. This is the High-severity pattern.
3. Do cached functions read root parameters or take binary arguments? Review those first after patching. My use cache guide explains how cache keys are built.
4. Do you self-host? Check whether you run next start and which reverse proxy sits in front, and whether it speaks HTTP/1.1 to the backend.
5. Do Edge routes set cookies? Search for NextResponse.cookies.set in routes with runtime = "edge".
6. Do you serve SVG-adjacent images? Keep dangerouslyAllowSVG off and keep remotePatterns tight.

Patching fixes all of these regardless of the answers, so treat the checklist as a way to decide how urgent it is, not whether to upgrade.

What about the previous Next.js security update?#

This is the second security release in about a month. If you missed the earlier one, see my Next.js security update from October 2026. Both releases came with an advance notice from the Next.js team, so watching the Next.js blog is the easiest way to know when to patch.

Key takeaways#

• Next.js 16.4.5 and 15.5.29 shipped on November 3, 2026 and fix seven issues: one High, six Medium.
• The High issue is a cross-tenant leak when use cache and unstable_cache wrap the same public function and it reads a root parameter.
• Most issues need Cache Components, so check your config, but patch regardless.
• Self-hosters behind an HTTP/1.1 proxy and Edge routes that set cookies have separate issues.
• Run npm install next@16.4.5 (or next@15.5.29) and redeploy.