Is next 16.3 vulnerable?
npm · 9 releases from 16.3.0 to 16.3.8 · latest next is 16.4.3 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. next 16.3.8, the last 16.3 release, is affected by 3 known security advisories (2 critical, 1 high), including CVE-2026-94482. 10 more affect earlier 16.3.x releases. Upgrade to 16.4.1 or later to fix all of them.
npm install next@16.4.1Advisories affecting next 16.3.8
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- Affected
- >=16.0.0 <16.4.1
- Fixed in
- 16.4.1
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Affected
- >=10.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Fixed within 16.3.x, affecting earlier releases
next.js cache leak across root param values in nested 'use cache' functions
- Affected
- >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
- Affected
- >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
- Affected
- >=15.0.0 <15.5.27 · >=16.0.0 <16.3.8
- Fixed in
- 15.5.27, 16.3.8
Next.js has information disclosure in development server's Model Context Protocol endpoint
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
- Affected
- >=16.0.0 <16.3.8 · >=15.0.0 <15.5.27
- Fixed in
- 15.5.27, 16.3.8
Next.js has Server-Side Request Forgery in Image Optimization
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js: Remote Code Execution in next/og ImageResponse
- Affected
- >=16.2.0 <16.3.6
- Fixed in
- 16.3.6
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- Affected
- >=10.0.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
- Affected
- >=13.4.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Which of your client projects are still on next 16.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.