Is next 16.0 vulnerable?
npm · 12 releases from 16.0.0 to 16.0.11 · latest next is 16.4.3 · checked 1 Nov 2026
Yes: 40 known advisories
Yes. next 16.0.11, the last 16.0 release, is affected by 40 known security advisories (4 critical, 14 high, 18 medium, 4 low), including CVE-2026-75604, CVE-2026-94482, CVE-2026-94483. 5 more affect earlier 16.0.x releases. Upgrade to 16.4.1 or later to fix all of them.
npm install next@16.4.1Advisories affecting next 16.0.11
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- Affected
- >=16.0.0 <16.4.1
- Fixed in
- 16.4.1
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Affected
- >=10.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
- Affected
- >=15.0.0 <15.5.27 · >=16.0.0 <16.3.8
- Fixed in
- 15.5.27, 16.3.8
Next.js has information disclosure in development server's Model Context Protocol endpoint
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
- Affected
- >=16.0.0 <16.3.8 · >=15.0.0 <15.5.27
- Fixed in
- 15.5.27, 16.3.8
Next.js has Server-Side Request Forgery in Image Optimization
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- Affected
- >=10.0.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
- Affected
- >=13.4.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Server-Side Request Forgery in Server Actions on custom servers
- Affected
- >=14.1.1 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Cache confusion of response bodies for requests with bodies
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unbounded Server Action payload in Edge runtime
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Affected
- >=12.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Denial of Service in the Image Optimization API using SVGs
- Affected
- >=15.5.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unauthenticated disclosure of internal Server Function endpoints
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Affected
- >=16.0.0 <16.2.11
- Fixed in
- 16.2.11
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- Affected
- >=15.2.0 <15.5.18 · >=16.0.0 <16.2.6
- Fixed in
- 15.5.18, 16.2.6
Next.js's Middleware / Proxy redirects can be cache-poisoned
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
- Affected
- >=13.4.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
- Affected
- >=13.4.6 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
- Affected
- >=15.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service in the Image Optimization API
- Affected
- >=10.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
- Affected
- >=13.4.13 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cache poisoning in React Server Component responses
- Affected
- >=14.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- Affected
- >=15.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
- Affected
- >=15.4.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js Vulnerable to Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.15 · >=16.0.0-beta.0 <16.2.3
- Fixed in
- 15.5.15, 16.2.3
Next.js: HTTP request smuggling in rewrites
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=9.5.0 <15.5.13
- Fixed in
- 15.5.13, 16.1.7
Next.js: Unbounded next/image disk cache growth can exhaust storage
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=10.0.0 <15.5.14
- Fixed in
- 15.5.14, 16.1.7
Next.js: Unbounded postponed resume buffering can lead to DoS
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js: null origin can bypass Server Actions CSRF checks
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js: null origin can bypass dev HMR websocket CSRF checks
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
- Affected
- >=16.0.0-beta.0 <16.1.5 · >=15.0.0-canary.0 <=15.0.0-canary.205 · >=15.0.1-canary.0 <=15.0.1-canary.3 · >=15.0.2-canary.0 <=15.0.2-canary.11 · >=15.0.3-canary.0 <=15.0.3-canary.9 · >=15.0.4-canary.0 <=15.0.4-canary.52 · >=15.1.1-canary.0 <=15.1.1-canary.27 · >=15.2.0-canary.0 <=15.2.0-canary.77 · >=15.2.1-canary.0 <=15.2.1-canary.6 · >=15.2.2-canary.0 <=15.2.2-canary.7 · >=15.3.0-canary.0 <=15.3.0-canary.46 · >=15.3.1-canary.0 <=15.3.1-canary.15 · >=15.4.0-canary.0 <=15.4.0-canary.130 · >=15.4.2-canary.0 <=15.4.2-canary.56 · >=15.5.1-canary.0 <=15.5.1-canary.39 · >=15.6.0-canary.0 <15.6.0-canary.61
- Fixed in
- 15.6.0-canary.61, 16.1.5
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
- Affected
- >=10.0.0 <15.5.10 · >=15.6.0-canary.0 <16.1.5
- Fixed in
- 15.5.10, 16.1.5
Fixed within 16.0.x, affecting earlier releases
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
- Affected
- >=13.0.0 <15.0.8 · >=15.1.1-canary.0 <15.1.12 · >=15.2.0-canary.0 <15.2.9 · >=15.3.0-canary.0 <15.3.9 · >=15.4.0-canary.0 <15.4.11 · >=15.5.1-canary.0 <15.5.10 · >=15.6.0-canary.0 <15.6.0-canary.61 · >=16.0.0-beta.0 <16.0.11 · >=16.1.0-canary.0 <16.1.5
- Fixed in
- 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
- Affected
- >=13.3.1-canary.0 <14.2.35 · >=15.0.6 <15.0.7 · >=15.1.10 <15.1.11 · >=15.2.7 <15.2.8 · >=15.3.7 <15.3.8 · >=15.4.9 <15.4.10 · >=15.5.8 <15.5.9 · >=15.6.0-canary.59 <15.6.0-canary.60 · >=16.0.9 <16.0.10 · >=16.1.0-canary.17 <16.1.0-canary.19
- Fixed in
- 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19
Next Server Actions Source Code Exposure
- Affected
- >=15.0.0-canary.0 <15.0.6 · >=15.1.1-canary.0 <15.1.10 · >=15.2.0-canary.0 <15.2.7 · >=15.3.0-canary.0 <15.3.7 · >=15.4.0-canary.0 <15.4.9 · >=15.5.1-canary.0 <15.5.8 · >=15.6.0-canary.0 <15.6.0-canary.59 · >=16.0.0-beta.0 <16.0.9 · >=16.1.0-canary.0 <16.1.0-canary.17
- Fixed in
- 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17
Next Vulnerable to Denial of Service with Server Components
- Affected
- >=13.3.0 <14.2.34 · >=15.0.0-canary.0 <15.0.6 · >=15.1.1-canary.0 <15.1.10 · >=15.2.0-canary.0 <15.2.7 · >=15.3.0-canary.0 <15.3.7 · >=15.4.0-canary.0 <15.4.9 · >=15.5.1-canary.0 <15.5.8 · >=15.6.0-canary.0 <15.6.0-canary.59 · >=16.0.0-beta.0 <16.0.9 · >=16.1.0-canary.0 <16.1.0-canary.17
- Fixed in
- 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17
Next.js is vulnerable to RCE in React flight protocol
- Affected
- >=14.3.0-canary.77 <15.0.5 · >=15.1.0-canary.0 <15.1.9 · >=15.2.0-canary.0 <15.2.6 · >=15.3.0-canary.0 <15.3.6 · >=15.4.0-canary.0 <15.4.8 · >=15.5.0-canary.0 <15.5.7 · >=16.0.0-canary.0 <16.0.7
- Fixed in
- 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Which of your client projects are still on next 16.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.