Next.js 16.3.8 / 15.5.27 security release: check your next version

The fix

This is a version check only. If your app uses Next.js 15.x or 16.x, upgrade to a patched release and redeploy.

npm install next@15.5.27   # Maintenance LTS (15.5.x)
npm install next@16.3.8    # Active LTS (16.3.x)

Those install lines are from the official Next.js security blog (September 2026 Security Release). Matching GitHub releases: v16.3.8, v15.5.27.

After upgrading, redeploy. If you use images.remotePatterns, also audit allow-listed remote hosts (see below).

What’s fixed (official summary)

From the September 2026 Security Release and the linked advisories:

We are not ranking hosts or builders. If next is in your lockfile below the patched versions, upgrade.

What not to do

• Don’t leave a vulnerable next version pinned “because the app still works.”
• Don’t treat a WAF rule as a substitute for the upgrade.
• Don’t put secret API keys in client bundles while you patch (secret key in frontend bundle).

AI prompt

Check package.json and the lockfile for the "next" dependency version.
If it is on the 15.x line and below 15.5.27, or on the 16.x line and below 16.3.8,
propose upgrading to next@15.5.27 or next@16.3.8 respectively (stay on the same major line).
Show the diff and any peer-dependency notes first. Do not upgrade unrelated packages.
Wait for my OK before applying. After upgrade, remind me to audit images.remotePatterns
if we use remote images.

How to verify

1. npm ls next (or your package manager’s equivalent) shows 15.5.27 or 16.3.8 (or newer on that line).
2. Production build and deploy succeed.
3. If you use remote images: review images.remotePatterns for hosts you trust (Next.js images docs, linked from GHSA-cjq9-62q9-8jv4).
4. Smoke-test a cached page and a signed-in flow with two accounts where your app has private data.

Related

Pre-launch checklist · Own-cloud security guide · Secret key in frontend bundle

Your turn

Were you on 15.x or 16.x when you checked? Tell us which install line you used. We’ll keep the version table current when the next security release lands.