Next.js security updates: why patching can’t wait

What was fixed

The release is a broad one rather than a single headline bug. It covers several different classes of problem, and some of them can be triggered by anyone on the internet without logging in.

• Denial-of-service issues in streaming, image handling and the way server-component payloads are processed
• Cache poisoning, including image caches, middleware cache keys and a route-cache collision that could mix up content between tenants
• An authentication bypass affecting server actions in certain build paths
• A server-side request forgery (SSRF) fix in the proxy layer
• Cross-site scripting in development-mode tooling
• An upstream React Server Components deserialization issue

Who is affected

Projects on Next.js 15.0.0 to 15.5.17 and 16.0.0 to 16.2.5 should upgrade to 15.5.18 or 16.2.6. Versions 13 and 14 have no patched line, which means those sites need to move to a supported version rather than apply a quick fix. The related react-server-dom-* packages need updating to matching patched versions as well. Always confirm exact version numbers against the official Next.js advisories before you upgrade.

Why waiting is expensive

The moment an advisory is public, it also tells attackers where to look. Automated scanners start probing unpatched sites within days. A firewall rule can reduce the noise, but it cannot reliably block every one of these issues, so updating the framework is the only complete fix.

The impact is also very practical: denial-of-service means your site goes down during a campaign, and cache poisoning means your customers may be served the wrong content.

How to patch safely

• Upgrade next and the matching React packages together, then run npm ls to catch stale copies pulled in by other dependencies
• Run npm audit and confirm nothing related remains
• Test on a staging copy first: a full build, your login flow, forms and any streaming or dynamic pages
• Deploy, then watch error rates and response times for the first day
• Keep development servers bound to localhost, never exposed publicly
• Add a check to your build pipeline that fails when a known-vulnerable version is used

Key takeaways

• Upgrade Next.js 15 to 15.5.18 and Next.js 16 to 16.2.6, or move off version 13 and 14
• Update the matching React server-component packages at the same time
• Test on staging, then deploy and monitor
• Automate version checks so the next advisory never catches you off guard