Next.js is at or above the October 14 2026 patched release floors

The October 14 2026 Next.js security release fixed two Critical remote-code-execution advisories and one High denial-of-service advisory. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is unauthenticated RCE through Image Optimization with SVG input, and GHSA-673q-mjm6-r5xr is RCE through use cache functions that return typed arrays. GHSA-p3m5-59mp-jv5r is a denial of service in App Router Server Actions. The patched floors are 16.4.1 on the 16.x line and 15.5.28 on the 15.x line. An app resolving next below those floors is exposed to advisories with public write-ups, and generic dependency checks do not pin these floors. CWE-1104 and OWASP A06 apply.

Upgrade next to at least 16.4.1 (16.x line) or 15.5.28 (15.x line), then regenerate the lockfile so the resolved version moves too, not just the range in package.json.

# 16.x line
npm install next@16.4.1 eslint-config-next@16.4.1
# 15.x line (stay on 15.5, no major upgrade needed)
npm install next@15.5.28 eslint-config-next@15.5.28
npm ls next

Pin next to an exact version if you want upgrades to be deliberate, and keep eslint-config-next on the same version. If you cannot upgrade immediately, upgrade sharp to 0.35.5 or later as an interim mitigation for the image-optimization advisory and disable SVG handling in the image optimizer. Neither is a substitute for the upgrade. Add a CI step that fails when npm ls next reports a version below the floor.