Next.js fixes September 2026 image and cache vulnerabilities
Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.
The official advisory gives concrete triage conditions. Update to Next.js 16.3.8 or 15.5.27, then check whether the application uses Image Optimization with images.remotePatterns; the SSRF issue does not affect applications without that configuration. Self-hosted Pages Router applications using SSG or ISR need to review the cache replacement issue, while Vercel deployments are excluded from that specific condition. Root-level catch-all pages, Cache Components with Draft Mode, and the next dev MCP endpoint have additional separate exposure rules. Verify the deployed version, patch, and test image requests, route caches, previews, and development-only workflows.
Interview question
Which fixed release does the advisory list for the Next.js 15 maintenance line?
- a.15.5.27Correct
- b.15.3.8
- c.16.5.27
- d.14.5.27
Why? this is the answer
The advisory lists 15.5.27 as the Maintenance LTS fixed release and 16.3.8 as the Active LTS fixed release.
Just read this? Test yourself on what you have been reading.
Read the original → nextjs.org
- #Next.js
- #security
- #dependency maintenance
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles