News · written 11 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

Next.js is a popular open-source framework for building websites and web apps with React. On 3 November 2026 the Next.js team published a security release: Next.js 16.4.5 (the Active LTS line) and Next.js 15.5.29 (the Maintenance LTS line) fix seven vulnerabilities. The team says: Please patch your Next.js dependencies to maintain the security of your applications.

The release was announced a week ahead, on 27 October, as covering seven medium vulnerabilities. The final list has the same count, but one of them is now rated High.

The High one: cached data shown to the wrong tenant

Apps that use Cache Components could leak one tenant's cached data to another when a public use cache function reads a root parameter (such as a tenant ID) and is called both directly and inside unstable_cache. If you serve several customers or sites from one Next.js app, this is the one to look at first.

The six Medium ones

• Two more caching mix-ups with use cache: nested cached functions that read a root parameter, and binary arguments shared between callers.
• Shared shell cache poisoning in self-hosted apps (next start) with Cache Components on and Partial Prefetching off or unset.
• Response mix-ups between clients for self-hosted apps behind an HTTP/1.1 reverse proxy that reuses one backend connection.
• Cookie values exposed through an internal response header in Edge routes that set cookies with NextResponse.cookies.set().
• A way around the SVG check in Image Optimization when dangerouslyAllowSVG is false.

Most apps will not use every feature on that list, but the fix is the same for all of them.

What to do

Update the next package to the patched version for your line: npm install next@16.4.5 or npm install next@15.5.29, then rebuild and redeploy. The posts offer no workaround for people who cannot update.

Sources

• Next.js blog — November 2026 Security Release (3 November 2026)
• Next.js blog — Upcoming Next.js November Security Release (27 October 2026)

More news and guides at https://jmtechpower.com/articles.