Is Your Next.js Site Patched? The Sept 2026 Fixes

The short answer: Next.js published security releases on 22 and 30 September 2026. If your site runs Next.js 16, upgrade to 16.3.8. If it runs Next.js 15, upgrade to 15.5.27. The worst issue, a critical remote-code-execution flaw (CVE-2026-94545), affects 16.2.0 through 16.3.5 when a site generates images with next/og on the Node.js runtime. A 16.2 site has to move to 16.3; there is no 16.2.x fix. Next.js says two more fixes, one critical and one high, are still to come. And Next.js 15 leaves support on 21 October 2026. If someone else maintains your site, send them this paragraph.

This site runs on Next.js, and until 2 October it ran a version inside the critical advisory's range. So this post is partly a guide and partly a record of what happened when we checked our own site.

Next.js is the web framework, made by Vercel, that this site and many other business websites are built on. Being patched means running a version that includes the fixes for its published vulnerabilities. Those fixes only reach your site when someone changes one line in your project and redeploys. Your hosting company does not do it for you.

What shipped in September, and when

Two details in that table catch people out. First, 16.3.7 looks like the security release and isn't. If you upgraded to 16.3.7, you need to go again. Second, the September work is not finished. Next.js has said two further vulnerabilities will be addressed in a later release. As of 2 October, 16.3.8 is still the newest version on npm.

Which of the advisories apply to your site?

Eight advisories shipped in September. Most only apply to particular setups, which is why "am I affected?" has a real answer that depends on how your site was built.

Notice what the hosting column says, and doesn't. Vercel is named as unaffected for exactly one of these. Netlify says it applied platform-level mitigations for three — the image SSRF, the Draft Mode leak and the dev-server endpoint — and told customers to upgrade for the rest. "My host handles security" covers part of the list at best. The framework version in your project is yours.

The critical one, in plain terms

The September 22 flaw sits in the code that draws images on the fly. Sites commonly use it for social cards — the image that appears when someone shares a link on LinkedIn or iMessage. Next.js renders those through a library called Satori, and an escaping bug there could, in the advisory's words, lead to remote code execution: someone running their own code on your server.

GitHub's advisory is specific about the condition. A site is at risk when it passes attacker-controlled values into the image's text, attributes or styles using the Node.js version of ImageResponse. The Edge version is not affected. A site that only puts its own page titles into its social cards is a much harder target than one that renders, say, a visitor's name or a search term.

That distinction is useful for judging urgency. It is not a reason to skip the upgrade. Proving your site can't be exploited takes longer than patching it.

What we found on this site

We ran the same check on jagatjeet.com on 2 October 2026.

• Version: the site was on Next.js 16.2.9, inside the critical advisory's range.
• The affected component: the site draws its social cards with next/og in 17 routes, all on the default Node.js runtime. That is the exact code path the advisory names.
• Realistic exposure: the text in those cards comes from the site's own post titles and page data, not from anything a visitor types. The image allow-list names only the site's own domain, whose DNS the owner controls. We judged the real-world risk as low, but we didn't try to test it.
• The other six: not applicable. No Pages Router, no root catch-all, Turbopack builds, no Cache Components, and the dev-server issue never reaches production.
• The fix: one command — npm install next@^16.3.8 — then a full production build. It built clean on the first attempt, and we opened the generated social cards to confirm they were still real 1,200 × 630 images.

Checking turned up two things nobody was looking for. The social cards for every blog post and every Kamloops industry page had been showing a generic title instead of the page's own. The cause was a Next.js 16 change: route parameters became asynchronous, and those two image routes were still reading them the old way. It was fixed in the same update. And the upgrade moved sharp, the image library, to a version that no longer runs an install script — a small supply-chain win that showed up only because the lockfile was being read line by line.

None of that was dramatic, which is the point. A routine patch, done properly, is mostly reading.

Next.js 15 leaves support on 21 October

The September releases came with a deadline attached. Under Next.js's support policy, a major version gets security fixes for two years from its release. Next.js 15 was released on 21 October 2024, so it leaves Maintenance LTS on 21 October 2026 — eighteen days after this post. Next.js 14 is already unsupported.

So 15.5.27 is the right patch for a Next.js 15 site this week, and it is probably close to the last one. The two pending fixes may or may not land before the 21st. A site still on 15 in November will be running a framework that no longer gets security updates, and moving to 16 is a project with its own testing, not a one-line change. That is worth scheduling now, not after the next advisory. The step-by-step version, including the changes a clean build won't catch, is in how to upgrade from Next.js 15 to 16 before support ends.

How to check your own site

If you or your developer have fifteen minutes, this is the whole job.

1. Find your version. Open package.json and read the next line, or open your latest deployment's build log on Vercel — the first line prints it, for example ▲ Next.js 16.2.9.
2. Compare it with the patched versions. Below 16.3.8 on Next.js 16, or below 15.5.27 on Next.js 15, means you are missing fixes. On Next.js 14 or older, there is no patch to apply.
3. Upgrade and rebuild. Run npm install next@16.3.8 (or next@15.5.27), then a full production build. A 16.2 site moves a minor version, so read the build output, don't just check it finished.
4. Check the pages the fixes touch. Open a few of your social-card image URLs and any pages that use remote images. Those are where a regression would show.
5. Review the conditional advisories. Look at your images.remotePatterns allow-list, and confirm whether you self-host, use the Pages Router or enable Cache Components.
6. Put the next release in the calendar. Two fixes are still pending, and Next.js 15 sites have until 21 October. Set a reminder to check the Next.js blog next week.

If nobody on your side knows what package.json is, ask whoever built the site three questions: which Next.js version is live, when it was last updated, and who is responsible for applying security releases. A good answer takes them five minutes. No answer is the answer.

Common questions

Which Next.js version fixes the September 2026 vulnerabilities? Next.js 16.3.8 for version 16 and 15.5.27 for version 15, both released on 30 September 2026. They include the 22 September fix for the critical remote-code-execution flaw. Version 16.3.7, released a day earlier, is a bug fix and does not contain the security patches.

Is my site affected by the Next.js ImageResponse vulnerability? It is in scope if it runs Next.js 16.2.0 to 16.3.5 and generates images with next/og on the Node.js runtime, which is the default for image routes that don't opt into the Edge runtime. The risk is highest when visitor-supplied text reaches the image. Next.js 15 and the Edge runtime are not affected by the remote-code-execution issue.

Does hosting on Vercel protect me from these Next.js vulnerabilities? Only partly. Next.js names Vercel-hosted sites as unaffected by one of the eight advisories, the Pages Router cache-poisoning issue. The rest depend on your Next.js version, which lives in your project, not on the host. Upgrading the next package and redeploying is the fix.

When does Next.js 15 stop getting security updates? On 21 October 2026, two years after its release, when it leaves Maintenance LTS. Next.js 14 is already unsupported. A site still on 15 after that date will not receive security fixes, so plan the move to Next.js 16 now rather than after the next advisory.

Are there more Next.js security fixes coming? Yes. Next.js said on 30 September 2026 that two further vulnerabilities, one critical and one high, are waiting on upstream fixes and will be addressed in a later release. As of 2 October, 16.3.8 is still the latest version, so check the Next.js blog again next week.

How do I find out which Next.js version my website uses? Open the project's package.json and read the next entry, or look at the first line of the latest Vercel build log, which prints the version. If someone else maintains the site, ask them directly which version is live and who applies security releases.

The honest summary

Most sites running Next.js need a one-line change this week: 16.3.8 or 15.5.27. The critical flaw needs a specific condition, attacker-controlled text inside an image, but patching is cheaper than proving you are safe. Two more fixes are coming. And Next.js 15 sites have eighteen days of support left.

The reason these patches go unapplied on small-business sites is rarely difficulty. It is that nobody owns the job. If that describes your site, website care plans are what cover it — and what website maintenance actually covers is a fair list to hold any provider to. For a larger product team deciding how upgrades, dependencies and release discipline should work, that is web architecture consulting. The same habit runs through the npm supply-chain changes this year: read what you ship.

Sources: Next.js — Security Update for a Critical Upstream Issue (22 September 2026) · Next.js — September 2026 Security Release · GitHub advisory GHSA-vcvr-r3jv-pc5j · Next.js support policy · Netlify changelog, 30 September 2026

Written by Jagatjeet — Jagatjeet (jagatjeet.com) is a web design, web architecture and AI automation studio in Kamloops, British Columbia, serving the Thompson-Okanagan and BC Interior. Published 3 October 2026. Last updated 3 October 2026. Security advisories change quickly — check the Next.js blog for releases after this date.