Next.js September 2026 Security Releases: What Changed and How to Patch

September 2026 was a busy month for Next.js security. Vercel shipped two rounds of fixes: an out-of-band update on September 22 for a critical issue in next/og, and a scheduled security release on September 30 covering one high and several medium severity advisories. If you run Next.js in production, the short version is: upgrade to 16.3.8 (Active LTS) or 15.5.27 (Maintenance LTS). The longer version is worth reading, because several of the issues depend on specific features you may or may not use.

The Patched Versions

# Next.js 16.3 (Active LTS)
npm install next@16.3.8

# Next.js 15.5 (Maintenance LTS)
npm install next@15.5.27

These versions include the fixes from both September releases, so there's no need to step through 16.3.6 first.

September 22: Remote Code Execution in `ImageResponse` (Critical)

The out-of-band release addressed an issue in the Node.js implementation of ImageResponse from next/og, the API commonly used to generate Open Graph images. Under specific conditions, improper escaping in SVG output generated by Satori could lead to remote code execution through vulnerabilities in other upstream dependencies.

Affected: Next.js >=16.2.0 <16.3.6
Not affected: the Edge runtime ImageResponse, and Next.js 15.x (15.5.26 ships related hardening only)

If you have an opengraph-image.tsx or a route handler that returns new ImageResponse(...) on the Node.js runtime, this one applies to you:

// app/blog/[slug]/opengraph-image.tsx
import { ImageResponse } from 'next/og'

export const size = { width: 1200, height: 630 }
export const contentType = 'image/png'

export default async function Image({ params }: { params: Promise<{ slug: string }> }) {
  const { slug } = await params
  return new ImageResponse(<div style={{ fontSize: 64 }}>{slug}</div>, size)
}

September 30: The Scheduled Release

The second release fixed a set of issues whose impact depends heavily on how your app is configured.

Image Optimization SSRF (High)

An attacker-controlled URL that matches your allow-list could cause Server-Side Request Forgery, for example towards private IP ranges, during image optimization. Apps with no images.remotePatterns configured are not affected. If you do use remote patterns, this is also a good moment to tighten them:

// next.config.ts
import type { NextConfig } from 'next'

const nextConfig: NextConfig = {
  images: {
    remotePatterns: [
      // Be specific: exact host and a path prefix, not a wildcard domain
      { protocol: 'https', hostname: 'images.unsplash.com', pathname: '/photo-**' },
    ],
  },
}

export default nextConfig

Cache Poisoning in SSG/ISR (Medium)

Two separate advisories involve the response cache:

Self-hosted Pages Router apps with SSG or ISR pages could have a page's cache entry replaced with another route's content. Apps on Vercel are not affected.
Apps combining a root-level catch-all page with SSG or ISR routes could have the shared response cache poisoned by a single crafted, unauthenticated request.

Both lead to the wrong content being served to every visitor until the entry is revalidated.

`use cache` Issues with Cache Components (Medium)

Two advisories apply only if you've enabled Cache Components (or experimental.useCache):

A 'use cache' function that calls another 'use cache' function reading a root param could be keyed without that param, so content for one value could be served for another.
Pending cache fills were shared between Draft Mode and regular requests. A visitor overlapping an editor's preview could receive unpublished content, and that content could be persisted into a prerendered page.

If you run a headless CMS with Draft Mode previews and Cache Components, prioritize this upgrade.

Metadata Image Routes Ignoring `dynamicParams` (Medium)

With webpack builds, opengraph-image and twitter-image routes ignored dynamicParams = false, so attackers could request images for segments you deliberately excluded from generateStaticParams(). Turbopack builds are not affected.

Dev Server MCP Endpoint (Low)

next dev exposes a Model Context Protocol endpoint for AI coding tools. It didn't verify the request origin, so a malicious site open in your browser could read development data such as the project path, route list, error snippets and logs. Production deployments don't serve this endpoint, but every developer machine should still be updated.

A Practical Patch Checklist

1. Find every Next.js version you run

# In each repo or workspace
npm ls next

# Or for pnpm monorepos
pnpm why next -r

2. Upgrade and verify the lockfile

npm install next@16.3.8
npm ls next   # confirm a single, patched version
npm run build

3. Audit the features that change your exposure

Search the codebase for the features each advisory depends on:

grep -rn "remotePatterns" next.config.*
grep -rln "ImageResponse" app src
grep -rn "draftMode\|use cache" app src

4. Automate the next one

Enable Dependabot or Renovate security updates for next, and subscribe to the Next.js security advisories on GitHub so you hear about the next release at the same time as everyone else.

Key Takeaways

Upgrade to Next.js 16.3.8 or 15.5.27; both include all September 2026 fixes.
The critical RCE affected only the Node.js ImageResponse in Next.js 16.2 and later.
The SSRF only matters if you configure images.remotePatterns, so keep those patterns narrow.
Several cache issues are specific to self-hosting, catch-all routes, or Cache Components with Draft Mode.
Update developer machines too: the next dev MCP endpoint issue affects local environments.