Next.js 16.4.1

Overview

Next.js 16.4.1 was published on October 14, 2026 as an out-of-band security release. Vercel shipped it outside the normal minor cadence to close two critical unauthenticated remote code execution vulnerabilities and one server-side denial of service issue. Patched builds are available on both support lines: 16.4.1 for Active LTS and 15.5.28 for Maintenance LTS. No new features, API changes, or deprecations are included.

Security Fixes

• Image pipeline RCE, tracked as CVE-2026-96889. Applications that pass attacker-controlled values into SVG content processed through the Image Optimization API or ImageResponse could reach server-side code execution. The defect traces to the image processing dependency chain bundled with the framework, so wrapping user input in validation around the optimizer is not sufficient mitigation on its own.
• use cache RCE. The second critical issue allowed unauthenticated code execution through the use cache layer in affected 16.x releases. Any deployment that exposes cached server components or route handlers to untrusted traffic should be treated as exposed until patched.
• Server Action denial of service, tracked as GHSA-p3m5-59mp-jv5r. App Router applications that define a Server Action could be driven into a server-side denial of service condition by crafted requests. Lower severity than the two RCE issues, but trivially reachable on public endpoints.

Context From 16.4

The patch lands on top of Next.js 16.4, released October 6, 2026, which introduced lazy compilation, a smaller Turbopack output footprint, React 19.3 feature support, Cache Components improvements, and additional developer tooling. Projects still on 16.3.x are therefore two versions behind on both features and security.

Action Required

Upgrade to 16.4.1, or to 15.5.28 if you remain on the 15 line. Update lockfiles and redeploy rather than relying on a rolling restart, since the vulnerable code sits in server bundles. After deploying, confirm the resolved version in the running build output, and rotate any secrets reachable from code paths that touched the Image Optimization API or a use cache entry. Applications that cannot patch immediately should disable remote image optimization for untrusted URLs and keep Server Action endpoints behind authentication.