# Next.js 16.4.5 Security Release: What's Fixed and How to Patch (November 2026)

Next.js 16.4.5 and 15.5.29 fix seven security issues, one High and six Medium, most in Cache Components and use cache. What each advisory means, who is affected, and how to patch.

By Waseem Anjum · Published 2026-11-09 · Updated 2026-11-13 · https://fabwaseem.com/blog/nextjs-16-4-5-security-release

> **TL;DR:** On November 3, 2026, Vercel shipped Next.js 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS), fixing seven security issues: one High and six Medium. Four involve Cache Components or use cache, two affect self-hosted apps behind proxies, and the rest cover Edge cookies and image optimization. Patch with npm install next@16.4.5 or next@15.5.29.

On November 3, 2026, Vercel released **Next.js 16.4.5** (Active LTS) and **Next.js 15.5.29** (Maintenance LTS) to fix seven security issues: one rated High and six rated Medium. This guide covers the [official November 2026 security release](https://nextjs.org/blog/november-2026-security-release), explains who is affected, and shows how to patch.

## How do I patch Next.js?

Upgrade to the fixed version for your release line:

```bash
npm install next@16.4.5   # 16.4 line (Active LTS)
npm install next@15.5.29  # 15.5 line (Maintenance LTS)
```

The same works with `pnpm add` or `yarn add`. Then rebuild and redeploy. If you self-host with Docker, rebuild the image without cache so the new version is installed, as in my [Next.js Dockerfile guide](https://fabwaseem.com/blog/nextjs-dockerfile).

The advisory lists fixes for those two lines only. If you are on another version, check the linked GitHub advisories for your version, or move to a supported line.

## What was fixed in the November 2026 release?

| Severity | Issue | Needs |
| --- | --- | --- |
| **High** | Cross-tenant cache disclosure with `unstable_cache` and `use cache` ([GHSA-mfr8-8qww-v76h](https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h)) | Cache Components, a root parameter |
| Medium | Cross-root-parameter disclosure in nested `use cache` ([GHSA-vc7v-qv4w-wrv8](https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8)) | Cache Components, nested `use cache` |
| Medium | Cache poisoning through binary `use cache` arguments ([GHSA-rhh4-g77r-r9qj](https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj)) | `use cache` with binary arguments |
| Medium | Shared shell cache poisoning, self-hosted | `next start`, Cache Components |
| Medium | Response injection via stale compressed framing ([GHSA-pc58-hwjq-p385](https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385)) | Self-hosted, HTTP/1.1 proxy |
| Medium | Cookie exposure in `x-middleware-set-cookie` ([GHSA-f3mh-rxg3-f5g2](https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2)) | Edge routes that set cookies |
| Medium | SVG rejection bypass in Image Optimization ([GHSA-7qx7-33qx-rqx2](https://github.com/vercel/next.js/security/advisories/GHSA-7qx7-33qx-rqx2)) | Native image backend that decodes SVG |

![Diagram grouping the seven Next.js November 2026 fixes by what must be true in your app: four in Cache Components and use cache including the one High issue, one for self-hosted apps behind an HTTP/1.1 proxy, one for Edge routes and one for Image Optimization](https://res.cloudinary.com/wasicloudinary/image/upload/v1794197574/fabwaseem/projects/xcrgf8xl70ihhtehbg3l.jpg)

### The High issue: cross-tenant cache disclosure

If an app has Cache Components enabled and calls the same public `use cache` function both directly and from inside `unstable_cache`, content can leak across root-parameter values. The cached function must read a root parameter, such as a tenant identifier.

During a cold cache fill, a concurrent call through `unstable_cache` can receive another request's result without its root parameters being checked. That result can be stored and then served to later callers until the entry is revalidated or evicted. Where root parameters separate tenants, the result can contain another tenant's data.

### The Medium issues in the cache layer

- **Nested `use cache`.** An outer cached function can be stored before the inner function's root-parameter dependencies are recorded, when the inner function returns an early value alongside a slower asynchronous one. Tenant-, site- or locale-specific content can then be served across the routing boundary.
- **Binary arguments.** Distinct binary arguments passed to a `use cache` function can produce the same cache identity. If you use them to tell users or accounts apart, one caller can receive another's cached result.
- **Shared shell poisoning.** Self-hosted apps running `next start` with Cache Components on and Partial Prefetching off or unset can have a shared page shell poisoned by an unauthenticated request, giving wrong content or persistent 404s. The affected route shape is narrow and described in the advisory.

### The Medium issues outside the cache layer

- **Compressed response framing.** A self-hosted app that returns an attacker-controlled fetched `Response` unchanged can forward decompressed bytes with the original compressed framing headers. Behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection, responses can be assigned to the wrong clients. It does not apply to every proxy setup.
- **Edge cookie header.** `NextResponse.cookies.set()` in Edge route handlers can expose the serialized cookie in `x-middleware-set-cookie`, which same-origin JavaScript can read even for `HttpOnly` cookies. It needs attacker-controlled script on your origin. Node.js route handlers and `cookies().set()` were not affected in the reproduced case.
- **SVG bypass.** A crafted image from a permitted source can be misclassified as AVIF and slip past `images.dangerouslyAllowSVG: false`. Your image-source allowlist still applies, and the advisory says this alone does not demonstrate XSS or remote code execution.

## Am I affected? A quick checklist

1. **Do you use Cache Components?** Look for `cacheComponents` in `next.config` and `"use cache"` directives. If neither exists, the four cache-layer issues do not apply to you.
2. **Do you mix `unstable_cache` and `use cache`?** Search for `unstable_cache(` wrapping a function that is also marked `use cache`. This is the High-severity pattern.
3. **Do cached functions read root parameters or take binary arguments?** Review those first after patching. My [use cache guide](https://fabwaseem.com/blog/nextjs-use-cache) explains how cache keys are built.
4. **Do you self-host?** Check whether you run `next start` and which reverse proxy sits in front, and whether it speaks HTTP/1.1 to the backend.
5. **Do Edge routes set cookies?** Search for `NextResponse.cookies.set` in routes with `runtime = "edge"`.
6. **Do you serve SVG-adjacent images?** Keep `dangerouslyAllowSVG` off and keep `remotePatterns` tight.

Patching fixes all of these regardless of the answers, so treat the checklist as a way to decide how urgent it is, not whether to upgrade.

## What about the previous Next.js security update?

This is the second security release in about a month. If you missed the earlier one, see my [Next.js security update from October 2026](https://fabwaseem.com/blog/nextjs-security-update-october-2026). Both releases came with an advance notice from the Next.js team, so watching the Next.js blog is the easiest way to know when to patch.

## Key takeaways

- Next.js 16.4.5 and 15.5.29 shipped on November 3, 2026 and fix seven issues: one High, six Medium.
- The High issue is a cross-tenant leak when `use cache` and `unstable_cache` wrap the same public function and it reads a root parameter.
- Most issues need Cache Components, so check your config, but patch regardless.
- Self-hosters behind an HTTP/1.1 proxy and Edge routes that set cookies have separate issues.
- Run `npm install next@16.4.5` (or `next@15.5.29`) and redeploy.

## Questions

### Which Next.js versions fix the November 2026 security issues?

Next.js 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS), both released on November 3, 2026. Run npm install next@16.4.5 on the 16.4 line or npm install next@15.5.29 on the 15.5 line.

### How severe are the Next.js November 2026 vulnerabilities?

One is rated High and six are rated Medium. The High-severity issue is a cross-tenant cache disclosure (GHSA-mfr8-8qww-v76h) when the same public use cache function is called directly and from inside unstable_cache.

### Am I affected if I don't use Cache Components?

Four of the seven issues are described as affecting applications with Cache Components enabled or those using use cache. The Edge cookie header issue, the compressed response framing issue and the SVG image optimization issue are separate and do not depend on Cache Components.

### Does Vercel hosting need any action?

The advisory tells everyone to patch their Next.js dependency. Two of the issues are specifically described for self-hosted applications, so self-hosters are the most exposed, but every app should upgrade.

### What is the x-middleware-set-cookie issue?

App Router Edge Route Handlers and Pages Router Edge API routes that call NextResponse.cookies.set() can expose the serialized cookie in an internal x-middleware-set-cookie header. Unlike Set-Cookie, same-origin JavaScript can read it, even for HttpOnly cookies. It needs attacker-controlled JavaScript on your origin to matter.