Next.js Vulnerabilities (Oct 2026): Is Your Website Affected?

What happened: the October 2026 Next.js security update

Next.js is a popular framework that developers use to build websites and web apps with React. On 8 October 2026 the Next.js team gave advance notice of an out-of-band security release, and on 14 October it published the fixes in its security update post. Two of the fixes had been held back from the September 2026 release because of delays in upstream libraries.

On 20 October 2026, the Cyber Security Agency of Singapore issued the alert Critical Vulnerabilities in Next.js, rating both critical flaws at 9.5 out of 10 (CVSS v4.0) and advising users to update immediately.

Remote code execution means an attacker on the internet, without logging in, could run their own commands on the server that hosts your site. That can lead to defaced pages, stolen customer data, malware served to visitors or the server being used to attack others.

Affected and fixed Next.js versions

CSA's alert lists the affected versions as 16.x before 16.4.1 and 10.x to 15.x before 15.5.28. The Next.js team says the fixes are in 16.4.1 (the Active LTS line) and 15.5.28 (the Maintenance LTS line).

The Next.js support policy lists only 16.x and 15.x as supported. Versions 14 and earlier get no patch of their own, so a site on 13 or 14 has to jump at least to 15.5.28. That is a bigger job than a patch, which is why older sites take longer to fix.

How to check which Next.js version your site runs

You do not need to read code to get the answer. Ask whoever built or looks after the site, or follow these steps if you have access to the code repository.

1. 1

   Ask your developer for the exact version

   Send one written question: "Which Next.js version is our site on in production, and is it 15.5.28 / 16.4.1 or later?" A good developer answers the same day.

2. 2

   Or look in package.json

   In the project's code (for example on GitHub), open package.json and find the line for "next". The number next to it is the version range; the lockfile (package-lock.json, pnpm-lock.yaml or yarn.lock) shows the exact version installed.

3. 3

   Check what is actually deployed

   The code in the repository and the site that is live can differ. Ask for the date of the last production deploy and confirm it happened after the upgrade.

4. 4

   Check other apps too

   Internal dashboards, booking portals and staff tools are often built on Next.js as well. List every app your business runs, not only the main website.

If nobody can answer, that is a finding in itself: someone needs ownership of the site's code and hosting. Our website maintenance checklist covers what a maintenance arrangement should include.

Hosted on Vercel vs self-hosted: does it change anything?

Where the site runs affects how exposed it is, but not whether it needs patching. The Next.js team says its scheduled security releases let it work with hosting providers to deploy mitigations such as firewall rules for apps that are not yet patched (security release programme). Those mitigations are a stopgap, not a fix.

If your app was put together quickly with an AI coding tool and nobody maintains it, read our guide to vibe-coded apps and their business risks: unmaintained apps are the ones that stay on vulnerable versions for months.

When to rebuild, and signs the site was already attacked

Updating the version number in the code does nothing until the site is rebuilt and redeployed. Ask your developer to upgrade, run the build and tests, deploy to production and confirm the live version. On a well-kept project this is a small job; on a site that has not been touched for a year, dependency upgrades can take a few days.

Warning signs include unknown files or processes on the server, new admin users, outbound traffic you cannot explain, or pages that redirect visitors elsewhere. If you see any of these, treat it as an incident and follow our hacked website guide before simply patching, because patching does not remove an attacker who is already in.

Do it yourself or get help?

If you have a developer on retainer, send them the CSA alert and the version table above and ask for written confirmation of the deployed version. If the site was built by someone who has moved on, you need a developer who can upgrade the code, rebuild it and check the server.

IT Sorted is a Singapore-based team of developers with over 10 years of experience. Website Security Hardening (S$290) covers updates, firewall and backups for an existing site, and Care (S$129/month) keeps updates applied each month so the next advisory is routine. For an upgrade from Next.js 13 or 14, send us the repository details through the contact form for a written scope first.