The November 2026 Next.js Security Release ships patches in next@16.4.5 (Active LTS) and next@15.5.29 (Maintenance LTS). Per the official Next.js blog post, the findings mainly cover Cache Components, response framing, and Image Optimization — including one high-severity cache disclosure. This article covers impact and patch guidance only; no exploit steps or PoCs.
Operators should update dependencies promptly. The blog’s install guidance: npm install next@15.5.29 for the 15.5 line and npm install next@16.4.5 for 16.x (the blog comment mentions the 16.5 line; the published patch version is 16.4.5). Before production: regression tests on caching, prefetch, and Edge routes.
Next.js Security Release: High — cross-tenant cache
GHSA-mfr8-8qww-v76h (High): With Cache Components enabled, applications can disclose cached content across root-parameter values when the same public use cache function is called both directly and from inside unstable_cache, and that function reads a root parameter such as a tenant identifier.
During a cold cache fill, a concurrent call through unstable_cache can receive another request’s result without checking its root parameters. That result can then be stored and served to later callers with the same arguments until revalidation or eviction. Where root parameters separate tenants, the result can contain another tenant’s data. This is not a generic “turn caches off” finding — it is a specific combination of unstable_cache + use cache under Cache Components.
Medium: nested use cache and binary arguments
GHSA-vc7v-qv4w-wrv8 (Medium): Nested public use cache functions can serve content generated for one root-parameter value to requests for another. This affects apps where an inner cached function reads a root parameter and returns an early value alongside a slower asynchronous value, while the outer function finishes without waiting. The outer entry can be stored before the inner function’s root-parameter dependencies are recorded. The attacker does not inject arbitrary response content; the application generates the content that is incorrectly reused.
GHSA-rhh4-g77r-r9qj (Medium): Distinct binary arguments passed to a use cache function can produce the same cache identity. If those arguments distinguish users or accounts and the remaining identity inputs match, a caller can receive another user’s cached result or cause their own result to be served to another user. This does not permit arbitrary access to unrelated cache entries.
Medium: shared shell, framing, cookies, SVG
Shared shell cache poisoning (Medium): Self-hosted apps running next start with Cache Components enabled and Partial Prefetching disabled or unset can have a shared page shell poisoned by an unauthenticated request. A crafted URL can store request-specific values in a shell used by other URLs — incorrect server-rendered content or persistent 404s. Reported route shape: a prerenderable dynamic parameter requested with a value not generated at build time, at least two deeper parameters that are never prerendered, and a blocking fallback shell; a layout must read the shallower of those deeper parameters inside a Suspense boundary. Build-generated values and configs with Partial Prefetching enabled were not affected in the reported tests.
GHSA-pc58-hwjq-p385 (Medium): Self-hosted apps that return an attacker-controlled fetched Response unchanged can forward decompressed body bytes with the original compressed response’s framing headers. Behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection, responses can be assigned to the wrong clients. This does not apply to every reverse-proxy setup.
GHSA-f3mh-rxg3-f5g2 (Medium): App Router Edge Route Handlers and Pages Router Edge API routes that set cookies with NextResponse.cookies.set() can expose the serialized cookie in the internal x-middleware-set-cookie response header. Unlike Set-Cookie, same-origin JavaScript can read that header — even for HttpOnly cookies. Impact requires a sensitive cookie on an affected response and attacker-controlled JavaScript on the same origin. It is not an independent way to execute JavaScript. The reproduced leak did not affect Node.js Route Handlers or cookies().set().
GHSA-7qx7-33qx-rqx2 (Medium): An attacker-controlled image from a permitted source can be misclassified as AVIF and bypass images.dangerouslyAllowSVG: false. The image optimization backend can then identify and decode the original bytes as SVG, reaching a parser the app configured Next.js to exclude. The image-source allowlist still applies; a native image backend capable of decoding SVG is required. This increases exposure to SVG parser resource exhaustion or decoder vulnerabilities; XSS/RCE is not demonstrated by the finding itself.
Context and internal links
The Next.js Security Release is a bundled advisory with one High and several Medium findings — not a single CVE headline in the blog title. For multi-tenant routing with Cache Components, GHSA-mfr8 is the priority. Self-hosted setups without Partial Prefetching, Edge cookie flows, and Image Optimization pipelines need their own checklists.
Related Next.js security coverage on code404zero: the September 2026 security release, the Next.js 16.4 Cache Components release, and Image Optimization SSRF CVE-2026-94483. Teams that recently enabled Cache Components should plan patching and config review together.
What operators should do now
1) Patch to 16.4.5 or 15.5.29 in staging, then production. 2) Audit unstable_cache + use cache combinations that read root params. 3) Review nested use cache and binary cache args against tenant/user separation. 4) Self-hosted: align Partial Prefetching and shell behavior with the advisory. 5) Edge routes: review cookie sets via NextResponse.cookies.set(). 6) Image Optimization: keep SVG policy and allowed sources aligned with GHSA-7qx7.
Security program: Vercel points to the Open Source Bug Bounty; questions to security@vercel.com. For this article: impact and patch from the blog only — no exploit instructions, no reproducible payloads.
In short: the November 2026 Next.js Security Release patches next@16.4.5 and next@15.5.29. High is cross-tenant cache disclosure GHSA-mfr8; plus medium findings on nested cache, binary args, shell poisoning, framing, cookie leak, and SVG bypass. Primary source: the Next.js blog. Patch, review config, do not reproduce exploits.
