Next.js October 14 Security Patch Now Live: Upgrade Immediately

Next.js Emergency Security Patch Drops Today

The Next.js team has released its scheduled out-of-band security update today, Wednesday, October 14, 2026, patching two Critical and one High severity vulnerabilities in upstream dependencies. If you run any Next.js application in production, upgrading is not optional.

What Was Patched?

The October 14 release addresses three vulnerabilities in upstream dependencies that ship with Next.js:

  • Critical (CVSS 9.5): Heap buffer overflow in the upstream libheif AVIF decoder, reachable via sharp in Next.js Image Optimization – enables unauthenticated Remote Code Execution (RCE) on any server processing AVIF images.
  • Critical (CVSS 9.0): Windows path traversal flaw (CVE-2026-75604) affecting deployments that use both the Pages Router and App Router without Cache Components on Windows servers – a working public proof-of-concept already exists.
  • High: An additional upstream dependency vulnerability addressed in this out-of-band release.

Which Versions Are Patched?

Upgrade to one of the following patched releases immediately:

  • Next.js 16.x: Upgrade to 16.4.1 or later
  • Next.js 15.x: Upgrade to 15.5.28 or later

Next.js 13.x and 14.x have no patched release. You must migrate to the 15.5.x or 16.x branch. Note: Next.js 15 reaches End of Life on October 21, 2026 – just 7 days away – so migrating directly to 16.x is strongly recommended.

How to Upgrade

# For Next.js 16.x projects
npm install next@latest

# For Next.js 15.x projects (maintenance only)
npm install next@15.5.28

# Verify your installed version
npx next --version

Key Takeaways

  • Two Critical RCE vulnerabilities are now patched – upgrade immediately.
  • Windows-hosted Next.js apps mixing Pages Router and App Router are especially at risk from CVE-2026-75604, which has a public PoC exploit.
  • AVIF image optimization is the attack vector for the second Critical CVE – if you cannot upgrade immediately, consider disabling AVIF optimization as a temporary workaround.
  • Next.js 15 EOL is October 21, 2026 – use this patch window as the trigger to migrate to Next.js 16.
  • Vercel-hosted apps were automatically protected at the platform level, but you should still upgrade your next package version.

Background

The Next.js team pre-announced this out-of-band security release on October 8, 2026, giving developers a week to prepare. The patch was delivered on schedule today. This follows a pattern of increasingly proactive security communication from the Vercel team.

Hashtags: #NextJS #WebSecurity #JavaScript #WebDevelopment #CVE #SecurityPatch #Vercel #ReactJS

Sources and Resources:

Search

Categories

Archives