Next.js Patches Seven Caching and Cookie Flaws in November Security Release

Next.js’s November 2026 security release patches seven caching and cookie vulnerabilities, including one rated high severity for multi-tenant apps.

Sajil Memon

November 6, 2026

Next.js shipped its November 2026 security release on November 3, patching seven vulnerabilities across versions 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS). One flaw is rated high severity and can leak cached data between tenants in multi-tenant applications. The other six are medium severity, touching cache poisoning, cookie exposure on Edge routes, and an image optimization bypass. According to Vercel’s own advisory, teams running Next.js with Cache Components or self-hosted deployments should upgrade now.

What Actually Broke

The most serious issue, tracked as GHSA-mfr8-8qww-v76h, affects apps with Cache Components enabled that call the same public use cache function both directly and from inside unstable_cache. During a cold cache fill, a concurrent request can land in the wrong slot and get served to a different tenant before anyone checks whose data it actually is. If your app separates customers by a root parameter like a tenant ID, that’s exactly the scenario this breaks.

Two more disclosures follow the same shape at lower severity. GHSA-vc7v-qv4w-wrv8 covers nested use cache functions that can serve content built for one locale or tenant to a request for another, and GHSA-rhh4-g77r-r9qj describes binary arguments that can collapse to the same cache identity, letting one user’s cached result reach someone else. Vercel’s advisory is clear that none of these let an attacker inject arbitrary content; the application already generated the data, it just got handed to the wrong request.

Self-hosted deployments running next start get their own entry: a shared page shell can be poisoned by an unauthenticated request if Partial Prefetching is off and a specific routing shape is in play, leading to wrong content or persistent 404s on unrelated URLs. There’s also a cookie leak on Edge routes (GHSA-f3mh-rxg3-f5g2), where cookies set through NextResponse.cookies.set() can end up readable by same-origin JavaScript through an internal header, even when marked HttpOnly. And an image optimization bug (GHSA-7qx7-33qx-rqx2) lets a crafted image get misclassified as AVIF and decoded as SVG, bypassing images.dangerouslyAllowSVG: false entirely.

Who Needs to Act

If you’re running Next.js 16.x, the fix is npm install [email protected]. On the 15.5 Maintenance LTS line, it’s npm install [email protected]. Apps not using Cache Components are mostly in the clear for the cache-related bugs, but the cookie exposure and SVG issues are worth checking regardless of whether you’ve adopted that feature.

This is the second Next.js security release in about three weeks. We covered an emergency patch for two critical RCE flaws in mid-October, and this one is a different, lower-severity batch tied mostly to caching internals rather than code execution. Multi-tenant SaaS products and anything self-hosted outside Vercel’s own platform are the places to check first. If your team is maintaining a Next.js app and isn’t sure which of these apply, a quick audit under our web application development work is a faster way to confirm than reading all seven advisories line by line.

Sources

Written by

Sajil Memon

Sajil Memon is a co-founder of ConicPlex and a Senior Full Stack Developer focused on backend work: Node.js, PHP, APIs, and the infrastructure decisions that determine whether a system holds up under real traffic. He’s spent years on the side of a project that doesn’t get demoed, the part that has to keep working after launch. He writes here about the technical tradeoffs in backend architecture, deployment, and data handling that only become obvious once something breaks in production.