Next.js 16.2.5 Security Patch: Critical Vulnerabilities Fixed — Update Now

Next.js Releases Emergency Security Patch — v16.2.5 Now Available

Vercel has released Next.js v16.2.5 on May 6, 2026, addressing a broad set of critical security vulnerabilities across App Router, Pages Router, Server Components, and Image Optimization. If you’re running any version of Next.js 16.x or 15.x, you should update immediately.

A parallel patch — v15.5.16 — was also released simultaneously for teams still on the Next.js 15 branch.

🔴 High Severity Vulnerabilities Fixed

  • GHSA-8h8q-6873-q5fj — Denial of Service with Server Components
  • GHSA-267c-6grr-h53f — Middleware / Proxy bypass in App Router via segment-prefetch routes
  • GHSA-mg66-mrh9-m8jx — Denial of Service via connection exhaustion in Cache Components
  • GHSA-492v-c6pp-mqqv — Middleware / Proxy bypass through dynamic route parameter injection
  • GHSA-c4j6-fc7j-m34r — Server-Side Request Forgery (SSRF) in apps using WebSocket upgrades
  • GHSA-36qx-fr4f-26g5 — Middleware / Proxy bypass in Pages Router apps using i18n

🟡 Moderate Severity Vulnerabilities Fixed

  • GHSA-ffhc-5mcf-pf4q — Cross-Site Scripting (XSS) in App Router apps using CSP nonces
  • GHSA-gx5p-jg67-6x7h — Cross-Site Scripting (XSS) in beforeInteractive scripts with untrusted input
  • GHSA-h64f-5h5j-jqjh — Denial of Service in the Image Optimization API
  • GHSA-wfc6-r584-vfw7 — Cache poisoning in React Server Component responses

🟢 Low Severity Vulnerabilities Fixed

  • GHSA-vfv6-92ff-j949 — Cache poisoning via collisions in React Server Component cache-busting
  • GHSA-3g8h-86w9-wvmq — Middleware / Proxy redirects can be cache-poisoned

Who Is Affected?

These vulnerabilities affect applications using:

  • App Router with Server Components or Cache Components
  • Middleware or reverse proxy configurations
  • Pages Router with i18n routing
  • WebSocket upgrades in server-side code
  • CSP nonces or beforeInteractive scripts with user-supplied input
  • The built-in Image Optimization API

How to Update

Run the following command in your project to upgrade to the patched version:

# For Next.js 16.x users
npm install next@16.2.5

# For Next.js 15.x users
npm install next@15.5.16

# Or with yarn
yarn add next@16.2.5

Key Takeaway

This is a broad security release touching nearly every major subsystem of Next.js — from routing and middleware to image optimization and caching. The sheer number of high-severity advisories makes this one of the most significant security patches in Next.js history. Do not delay this update.

Hashtags: #NextJS #WebSecurity #JavaScript #ReactJS #WebDevelopment #SecurityPatch #Vercel #AppRouter

Resources:

Search

Categories

Archives