Next.js Security Advisories to Check in 2026

If you run Next.js, the exact patch version in your package.json is the single most important security fact about your site right now. Four critical vulnerabilities have hit the framework since March 2025, and whether you're protected depends on your precise version, not just your major version number.

This guide is for site owners and developers who want a plain-English rundown of the serious Next.js advisories so far, and a fast way to check if their own install is patched. You'll get a comparison table, the exact commands to find your version, and the reasoning behind why you need to update inside your release line, not just to any newer release.

The four critical Next.js advisories worth knowing about

All four are rated critical by the GitHub Advisory Database, which feeds into the OSV vulnerability database. None requires an exotic attack, each has a specific trigger condition, and each has a fixed version you can upgrade to.

1. The middleware authorization bypass (CVE-2025-29927)

Published March 21, 2025, this is the advisory that got the most attention. Middleware is the code that runs before a request reaches a page, and a lot of apps put login or permission checks there. This bug let an attacker skip that check entirely, without any credentials.

The advisory notes that Next.js deployments hosted on Vercel are automatically protected. If you self-host and can't patch immediately, the listed workaround is to block external requests carrying the x-middleware-subrequest header before they reach your app, for example at a reverse proxy or firewall. The real fix is the version bump: 15.2.3, 14.2.25, 13.5.9, or 12.3.5, depending on your line. Source: GitHub Advisory Database.

2. The React Server Components RCE (CVE-2025-55182)

Published December 3, 2025, and classified under CWE-502 (deserialization of untrusted data), this bug lives in the flight protocol, the format React Server Components use to send data between server and browser. The tracking identifiers for it are CVE-2025-55182 and GHSA-9qr9-h5gf-34mp.

It affects the underlying React packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, plus any framework built on them, including Next.js 15.x and 16.x apps using the App Router. The advisory's guidance is direct: everyone on stable 15.x or 16.x should upgrade to a patched, stable version. That means React 19.0.1, 19.1.2, or 19.2.1, and Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7, whichever matches your line. Source: GitHub Advisory Database.

3. Unauthenticated RCE on Windows-hosted servers (CVE-2026-75604)

Published September 8, 2026, this one only applies if your Next.js server runs on a Windows filesystem, using the Pages or App Router without the Cache Component. It affects every version back to 13.4.0. There's no listed workaround, so the only fix is updating to 15.5.24 or 16.3.3. If you host on Linux, or on a platform like Vercel, this specific advisory likely doesn't apply, but it's worth confirming with whoever manages your hosting. Source: GitHub Advisory Database.

4. Image Optimization RCE via SVG files on Linux

Published October 22, 2026, this hits the built-in Image Optimization API when it processes SVG files, on servers running glibc-based Linux (the standard C library used by most mainstream Linux distributions). The fix is Next.js 15.5.28 or 16.4.1, and it also requires the image library sharp to be version 0.35.5 or newer. We covered this one, alongside a related denial-of-service issue fixed in the same releases, in our write-up of the October 22 Next.js advisories. Source: GitHub Advisory Database.

How to check your Next.js version

You don't need to guess. Pick whichever matches your setup:

1. You have the code: open a terminal in your project folder and run npm ls next. It prints the installed version, like next@15.2.2.
2. No terminal handy: open package-lock.json and search the file for "next". In lockfile v2/v3 format, dependencies are listed alphabetically under node_modules paths, like node_modules/next, so the entry isn't necessarily near the top. You can also open node_modules/next/package.json and check the version field.
3. Using yarn or pnpm: run yarn list next or pnpm list next instead, same idea, different command.
4. It's not your code (an agency built it, or you're checking a site you don't manage): someone needs to look at the actual source. An outside scan can only read the version when the site happens to expose it in public scripts, and plenty of sites don't. That's part of why a manual review catches more than an automated scan.

Once you have your version number, compare it against the Fixed in column in the table above. If your version is lower than the fix for your release line, you're exposed to that advisory.

Why updating inside your release line actually matters

Each advisory lists several fixed versions, one per major release line (12.x, 13.x, 14.x, 15.x, 16.x). That's intentional: the Next.js team backports security fixes into supported lines rather than forcing everyone onto the newest major version immediately.

There's a catch, though. Older lines only get patched for issues the maintainers choose to backport, and eventually backports stop entirely. As of October 24, 2026, the OSV database listed 37 known advisories against Next.js 14.2.3 (4 critical, 13 high), and 25 of those are fixed only in Next.js 15 or later, meaning staying on the 14.x line can't resolve them. Next.js 15.1.0 had 36 listed advisories of its own (5 critical, 10 high). These counts shift as new advisories are published, but the pattern holds: the longer you sit on an old minor version, the more unpatched issues stack up, and some simply require moving to a newer major line. The latest stable release on npm as of that date was 16.4.3.

The practical takeaway: don't just bump to a fixed version, bump to the fixed version for your specific line, and check periodically whether your line is still receiving security backports at all. Being on an affected version is a reason to update, not proof that anything has actually gone wrong on your site. Read each advisory's specifics before assuming it applies to you.

Quick self-check before you move on

• [ ] I ran npm ls next (or checked package-lock.json) and know my exact version.
• [ ] I compared that version against the fixed versions for the advisories above.
• [ ] If I use middleware for auth checks, I've confirmed I'm past 15.2.3 / 14.2.25 / 13.5.9 / 12.3.5.
• [ ] If I use the App Router with React Server Components, my React and Next.js versions match the patched builds.
• [ ] I know whether my production server runs on Windows or Linux, and which image library version it uses.
• [ ] I've checked whether my hosting platform, like Vercel, already mitigates some of these automatically.

If any box is unchecked, that's your next task, not a reason to panic. For a broader gut check on your overall exposure, our guide to telling if your website is hackable walks through common gaps beyond just framework versions.

Key takeaways

• Four critical Next.js advisories have landed since March 2025: a middleware authorization bypass (CVE-2025-29927), a React Server Components RCE (CVE-2025-55182), a Windows-only RCE (CVE-2026-75604), and an SVG-triggered Image Optimization RCE.
• Each advisory lists a different fixed version per release line (12.x through 16.x), so check the version that matches your line, not just the newest release.
• Run npm ls next or check package-lock.json to get your exact installed version in under a minute.
• Staying on an old minor version compounds risk over time, and some issues are fixed only in newer major releases.
• Running an affected version means you should update it. It doesn't mean your site has already been breached.

A version check tells you about these specific framework bugs, not about misconfigured access controls, exposed admin routes, or weak authentication built on top of the framework. That's the gap a free passive website security check or a full manual audit is built to close. Bug Circuit's $49 Circuit plan has a real engineer manually review your site and hand you a written report with exact fixes, not just a version diff. See pricing if patching these advisories leaves you wanting a fuller check.