Next.js September 2026 security release (2026-09-30, 16.3.8 / 15.5.27): seven advisories — Image Optimization SSRF through an allow-listed remote pattern (CVE-2026-94483, High 8.3), two SSG/ISR cache-poisoning bugs, a Draft Mode `use cache` leak, a root-param cache leak, a `dynamicParams` bypass on OG-image routes, and a `next dev` MCP endpoint any website the developer visits can read (CVE-2026-94486) — while the pre-announced *critical* and one *high* were postponed for an upstream dependency; sharp 0.35.5 separately fixes a librsvg RCE (CVE-2026-96889, 8.9)

View raw markdownEdit on GitHub ↗

TL;DR

Vercel shipped its scheduled September 2026 security release on 2026-09-30 — Next.js 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS), both on npm at 16:07–16:19 UTC — with seven advisories: one High, five Medium, one Low. That is two fewer than the nine (one critical, two high) pre-announced on 09-23: the release post says "a fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays," and no id, range or date has been published for either. The High is CVE-2026-94483 (CVSS 8.3) — if your next.config has images.remotePatterns, an attacker-controlled URL that matches a pattern can make the Image Optimization endpoint fetch private addresses. Two Medium bugs let a single unauthenticated request poison the shared SSG/ISR cache so every later visitor gets the wrong page (self-hosted only for one; Vercel-hosted apps are not affected by it). Two more Medium bugs leak content across use cache keys — one of them serves unpublished Draft Mode content to anonymous visitors and can persist it into the prerendered page. The Low, CVE-2026-94486, is the one this audience should read twice: next dev on Next.js 16 exposes a Model Context Protocol endpoint that does not check where a request came from, so any website a developer visits while the dev server is up can read the project's path on disk, source snippets from error overlays, the route inventory and dev logs. Production never serves it. Separately, the image stack's native dependency sharp published CVE-2026-96889 (High 8.9) the same day: a use-after-free in bundled librsvg that is "possible remote code execution on glibc-based Linux," fixed in sharp 0.35.5 (npm 2026-09-27). Upgrade next and sharp, and keep watching the Next.js blog for the postponed critical.

What happened

Timeline. 2026-09-22: out-of-band 16.3.6 / 15.5.26 for the Satori next/og RCE. 09-23: pre-announcement of a 09-30 scheduled release for "nine vulnerabilities: one critical, two high, five medium, one low" as 16.3.7 / 15.5.27. 09-29 09:04 UTC: next@16.3.7 published (a regular release). 09-30 16:07 / 16:19 UTC: 16.3.8 and 15.5.27 published; the seven vendor advisories on vercel/next.js are dated 09-30 and the CVE records (CNA GitHub) 10-02. The release post's authors are Josh Story, Karim Rahal and Sebastian Silbermann; every advisory credits eps1lon (Sebastian Silbermann, a Next.js core maintainer) as finder — this batch is the vendor auditing itself.

The seven, in the release post's order:

Id Title (vendor) Severity Affected → fixed Who is exposed
CVE-2026-94483 / GHSA-cjq9-62q9-8jv4 Server-Side Request Forgery in Image Optimization High 8.3 16.0.0 – 16.3.7 → 16.3.8 "An attacker-controlled, allow-listed remote URL can lead to SSRF (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected."
CVE-2026-94543 / GHSA-4jqv-mc3x-m676 Cache poisoning of SSG and ISR pages in self-hosted Next.js applications Medium 6.3 15.0.0+ → 15.5.27; 16.0.0+ → 16.3.8 Pages Router with SSG/ISR, self-hosted: "a page's cache entry replaced with content from a different route … until the entry is revalidated. Applications deployed on Vercel are not affected."
CVE-2026-94484 / GHSA-mcj8-r9mp-w47p Cache poisoning in SSG/ISR rendering leads to cross-user content substitution and persistent denial of service Medium 6.3 15.0.0+ → 15.5.27; 16.0.0+ → 16.3.8 Apps with "a root-level catch-all page together with statically generated or ISR routes … poisoned by a single unauthenticated crafted request."
CVE-2026-94485 / GHSA-f87g-xv8r-7p7x Information disclosure in App Router metadata image routes via dynamicParams bypass Medium 6.3 16.0.0+ → 16.3.8 webpack builds only: opengraph-image / twitter-image ignore dynamicParams, so segments "deliberately excluded from generateStaticParams()" can be requested. Turbopack builds are not affected.
CVE-2026-103004 / GHSA-h694-7cp9-m8p3 Cache leak across root param values in nested use cache functions Medium 6.3 16.3.0 – 16.3.7 → 16.3.8 Cache Components: an outer 'use cache' function calling an inner one that reads a root param is keyed without that param, so "content produced for one root param value can be served for a different value." Not attacker-selectable.
CVE-2026-94544 / GHSA-3w37-wq28-93x7 Pending use cache fill can leak Draft Mode content into regular responses and persisted pages Medium 6.3 16.3.0 – 16.3.7 → 16.3.8 Cache Components or experimental.useCache plus Draft Mode previews: "a regular request that overlaps an editor's Draft Mode request receives unpublished content without any authentication; if that request prerenders a page, the unpublished content can be persisted … and served to all later visitors until the page is revalidated."
CVE-2026-94486 / GHSA-39w2-rjm5-chcv Information disclosure in the development server's Model Context Protocol endpoint Low 2.3 16.0.0 – 16.3.7 → 16.3.8 next dev only: the MCP endpoint "does not verify which website a request originates from, allowing a malicious website visited by the developer to read … the project's location on disk, source code snippets from error reports, the route inventory, and development logs."

What was postponed. The 09-23 pre-announcement counted nine; the 09-30 post shipped seven and says the critical and one high were "postponed due to upstream dependency delays." Nothing further is published: no id, no component, no date. This corpus's own rule after August's libheif critical and September's Satori critical is not to guess the dependency. What is on the record the same day is adjacent: sharp — the native image library Next.js's Image Optimization uses — published GHSA-wq5f-xc86-pv6w / CVE-2026-96889 (High, CVSS 4.0 8.9, CWE-416) on 09-30: a memory bug in the bundled librsvg that can lead to "possible remote code execution (RCE) on glibc-based Linux" under certain runtime conditions, fixed in sharp ≥ 0.35.5 (ships librsvg 2.63.2; npm 2026-09-27). The advisory's workarounds are a PIE-compiled Node binary or sharp.block({ operation: ["VipsForeignLoadSvg"] }). Whether that is the postponed High, or unrelated, is not stated anywhere this sweep read; treat it as its own upgrade.

Why the dev-server MCP bug matters more than its 2.3. Next.js 16's dev server ships an MCP endpoint so coding agents can introspect the running app. The advisory describes the classic "localhost service with no origin check" shape — the same class as the Cline hub CSWSH, the mcp-chrome-bridge native server and the DBHub DNS-rebinding entries — but on a port that is open on every Next.js 16 developer's laptop for most of the working day. The score is low because the data is development data; the lesson is that agent-facing local endpoints are now a standard component of frontend tooling and need the same origin discipline as any other local server. Netlify's 10-04 changelog notes the metadata-image bug still applies to webpack builds on its platform, that its Image CDN takes the SSRF out of band for its customers, and recommends @netlify/plugin-nextjs 5.16.1 plus a redeploy.

A record-keeping note for anyone reading the CVE JSON. The CNA record for CVE-2026-94485 carries the title and GHSA reference of the dynamicParams bug but its description is the next dev MCP text (identical to CVE-2026-94486's); NVD's copy inherits the error. The vendor advisory GHSA-f87g-xv8r-7p7x, the release post and the title all agree on the pairing used in the table above. Scanners keyed on description text will mis-describe 94485.

Am I affected?

# Version
npm ls next 2>/dev/null | grep ' next@'      # fixed: 16.3.8 (16.x) or 15.5.27 (15.x)
npm view next time --json | grep -E '"(16\.3\.8|15\.5\.27)"'   # both 2026-09-30

# Which of the seven apply to you
grep -n "remotePatterns" next.config.* 2>/dev/null          # CVE-2026-94483 (SSRF) only if set
grep -rln "draftMode\|useCache\|cacheComponents" --include=*.{js,ts,tsx,mjs} . | head   # 94544 / 103004
ls app/**/opengraph-image* app/**/twitter-image* 2>/dev/null   # 94485 (webpack builds only)
ls pages 2>/dev/null | head -1 && echo "Pages Router present: check 94543/94484 if self-hosted SSG/ISR"

# sharp (bundled by Next.js image optimization; also direct installs)
npm ls sharp 2>/dev/null | grep ' sharp@'    # fixed: 0.35.5+

Vercel-hosted apps are not affected by CVE-2026-94543; Netlify says its Image CDN removes the SSRF for its customers. Everyone else self-hosting is the target population for the cache bugs.

If you are affected

  1. Upgrade to next@16.3.8 or next@15.5.27 and redeploy. 16.3.7 is not a security release.
  2. Upgrade sharp to ≥ 0.35.5 wherever it is installed directly, and rebuild any Docker image that pins an older Next.js (the bundled copy moves with next).
  3. If you self-host SSG/ISR pages: revalidate or purge the page cache after upgrading — a poisoned entry persists until revalidation.
  4. If you use Draft Mode with Cache Components: check whether any prerendered output since 16.3.0 contains unpublished content (CVE-2026-94544 can persist it); regenerate affected pages.
  5. For the SSRF: review every images.remotePatterns entry for wildcard hosts or hosts that redirect; tighten to exact hostnames and paths.
  6. Developers: restart next dev after upgrading; until then do not browse untrusted sites with a Next.js 16 dev server running.
  7. Watch for the postponed critical. Subscribe to vercel/next.js advisories or the Next.js blog; this corpus will update this file when it ships.

Update 2026-10-09: the postponed fixes have a date

On 2026-10-08 Vercel pre-announced an out-of-band security update for Wednesday 2026-10-14. The post says it "will address three vulnerabilities in upstream dependencies: two Critical and one High", and that two of the fixes are the ones postponed from the September release. No ids, components or affected versions are published yet. The advisories ship with the update. Status here stays patched for the seven September advisories. The October items get their own entry when they land.

Prevention

  • This is the fourth Next.js security release in six weeks (08-25 criticals, 09-22 Satori, 09-30 scheduled, and the out-of-band update announced for 10-14). Keep next unpinned within a minor and on the LTS line the Security Release Program targets; see prevention/npm-hardening.md.
  • Local agent endpoints — MCP servers in dev tooling, IDE bridges, Hub dashboards — need origin/host validation like any other localhost service; see prevention/mcp-hygiene.md.
  • Cache poisoning via a single crafted request is a shared-cache design problem; put a CDN with its own cache key normalisation in front of self-hosted ISR, and alert on revalidate storms. playbooks/if-your-webapp-was-compromised.md covers the purge-and-verify steps.

Sources