Next.js Security Patches: Every CVE From September and What to Upgrade Before October 14

Before we dive in, why not take a quick peek at my portfolio: https://priyalraj.com

📋 TL;DR: What You’ll Learn Here

• The critical RCE in next/og from September 22, & who’s actually affected.

• The September 30 batch: an SSRF, three cache poisoning bugs, & a dev server leak.

• What we know about the out-of-band update landing October 14.

• The exact versions to upgrade to, & a quick checklist to run on your apps today.

🚨 Why I’m Writing This

September was a rough month for Next.js security. Two separate advisory drops, a Critical RCE, & now the Next.js team has announced another out-of-band update for October 14 with two more Critical fixes.

If you’re like me & run a bunch of Next.js apps (client sites, admin panels, side projects), it’s very easy to lose track of which app is on which version. So here’s everything in one place.

My tip: Don’t wait for the October 14 release to start. Get every app onto the current patched version now, so on the 14th it’s a tiny bump, not a scary jump.

💣 September 22: Critical RCE in next/og

CVE-2026-94545 (GHSA-vcvr-r3jv-pc5j), severity Critical.

What is it?

next/og gives you ImageResponse, the thing most of us use to generate dynamic Open Graph images. You write JSX, it renders an image.

The bug: on the Node.js runtime, if attacker-controlled values end up inside the generated SVG content, attributes or styles, it could lead to remote code execution.

Think about how common this pattern is:

// app/og/route.jsx
import { ImageResponse } from 'next/og';

export async function GET(request) {
  const { searchParams } = new URL(request.url);
  const title = searchParams.get('title'); // 👈 attacker controls this

  return new ImageResponse(
    <div style={{ fontSize: 64 }}>{title}</div>,
    { width: 1200, height: 630 }
  );
}

A blog title straight from the query string into your OG image. I’ve written this exact code more than once. 😅

Who’s affected?

• Versions: >= 16.2.0 & < 16.3.6.

• Runtime: Only the Node.js ImageResponse. The Edge runtime version is not affected.

• Fixed in: 16.3.6.

Workaround if you can’t upgrade today

Don’t pass untrusted values into the SVG. Look up the title from your DB using an ID or slug instead of taking raw text from the URL:

const slug = searchParams.get('slug');
const post = await getPostBySlug(slug); // your own data, not user input
if (!post) return new Response('Not found', { status: 404 });

Honestly, this is better practice anyway. It also stops people from generating OG images of your brand saying whatever they want.

📦 September 30: The Big Batch

Eight days later, a second drop. All of these are fixed in 16.3.8, & the three marked 15.x are also fixed in 15.5.27.

Let’s go through the ones that matter most.

🌐 CVE-2026-94483: SSRF in Image Optimization (High)

SSRF (Server-Side Request Forgery) is when an attacker tricks your server into making requests on their behalf. Think of it like someone handing your office receptionist a note saying “please call this number for me”. The call comes from your building, not theirs.

This one goes through images.remotePatterns. If you allow-list remote hosts for next/image, the image optimizer could be abused to make requests it shouldn’t.

• Not affected: apps with no remotePatterns configured.

• Workaround: Audit your allow-list. Make every pattern as tight as possible:

// next.config.js
module.exports = {
  images: {
    remotePatterns: [
      // ❌ too loose
      // { protocol: 'https', hostname: '**' },

      // ✅ exact host + path prefix
      { protocol: 'https', hostname: 'cdn.sanity.io', pathname: '/images/**' },
    ],
  },
};

I’ve seen hostname: '**' in real production configs. If that’s you, fix it today, patch or no patch.

🗄️ CVE-2026-94543: Pages Router Cache Poisoning (Medium)

If you’re on the Pages Router with SSG or ISR, a crafted request could poison the cache, so other users get served the attacker’s version of a page.

The important detail: Vercel deployments are not affected. This hits self-hosted apps, so Docker, VPS, NGINX in front of next start, that whole crowd. Which is a lot of us, especially in India where a ₹500/month VPS beats a Vercel bill.

💥 CVE-2026-94484: Catch-All Cache Poisoning DoS (Medium)

If you have a root catch-all page (like pages/[...slug].js or app/[...slug]/page.js) alongside SSG/ISR routes, one crafted request could poison the cache & cause a persistent denial of service. Not “slow for a minute”. Broken until the cache entry is cleared.

🔐 The two use cache bugs (Medium)

Both of these hit the newer caching model:

• CVE-2026-94544: A pending use cache fill could leak Draft Mode content. So your unpublished CMS drafts could reach normal visitors.

• CVE-2026-103004: With cacheComponents: true, nested 'use cache' functions could leak data across root params. If your root param is something like a tenant or locale, that’s data from one tenant showing up for another. No workaround, you have to upgrade.

🛠️ CVE-2026-94486: next dev MCP Endpoint (Low)

The dev server exposes an MCP endpoint so AI agents can inspect your running app. It didn’t check where requests came from, so a malicious website open in your browser could read your project path, source snippets, routes & logs while next dev was running.

Dev only, so production isn’t affected. But it’s a good reminder: the dev server is a server too.

⏰ October 14: What’s Coming

On October 8, the Next.js team published a heads-up: an out-of-band release lands on October 14, 2026 fixing three vulnerabilities in upstream dependencies:

• 2 Critical

• 1 High

Two of these were originally planned for the September release but got postponed. Full advisories, CVE IDs & affected versions will be published with the update, not before. That’s standard practice, so attackers don’t get a head start.

So right now we don’t know which features are affected. That’s exactly why you should be on 16.3.8 / 15.5.27 today, so you can jump straight to the new patch the moment it ships.

✅ What To Do Right Now

1. Check what version you’re on

# in each Next.js project
bun pm ls | grep next
# or
npm ls next

In a monorepo, check every app. Your client might be patched while the admin panel is still three versions behind. Ask me how I know.

2. Upgrade

# Next.js 16
bun add next@16.3.8
# or: npm install next@16.3.8

# Still on Next.js 15
bun add next@15.5.27
# or: npm install next@15.5.27

Or just grab the latest 16.x. At the time of writing, npm’s latest is 16.4.0, which was released after both September patches, so it includes them too.

3. Audit your code (10 minutes, tops)

• 🔍 Search for ImageResponse & check what goes into it. Anything from searchParams, headers or the request body = untrusted.

• 🔍 Open next.config.js & check images.remotePatterns. No wildcards on hostname.

• 🔍 Self-hosting with Pages Router + ISR? Upgrading isn’t optional for you.

• 🔍 Using cacheComponents or Draft Mode? Upgrade, there’s no workaround.

4. Be ready on October 14

Watch the Next.js blog & security advisories on the 14th. Since you’ll already be on the latest patch, the upgrade should be a one-liner.

Final Thoughts

None of this means Next.js is “insecure”. Every big framework ships CVEs, & the Next.js team is being pretty transparent with heads-up posts & workarounds.

But it does mean “set it & forget it” doesn’t work for production apps anymore. Pin a reminder to check advisories every couple of weeks, keep every app in your monorepo on the same version, & never feed raw user input into things like ImageResponse.

Update today, & update again on the 14th. 🔒

If you enjoyed this article, please make sure to follow me on Twitter.