Netlify urges Next.js upgrades despite narrower exposure to security flaws

Netlify told customers on October 14, 2026, to upgrade and redeploy their Next.js applications following the disclosure of three security vulnerabilities. The fixes are in Next.js 15.5.28 and 16.4.1; Netlify says its hosting infrastructure limits the impact of some flaws, but it still recommends installing the updates as soon as possible.

The distinction is clearest for the image-processing vulnerability, CVE-2026-96889. According to the Next.js advisory, a memory-related flaw in an upstream library can allow remote code execution on glibc-based Linux systems. Updating the sharp dependency used by Next.js to version 0.35.5 or later is a workaround for this issue; upgrading Next.js supplies a fixed version.

On Netlify, the Image Optimization API described in that advisory is served by the company's Image CDN rather than a customer's function, so Netlify says that route does not exercise the flaw. Applications rendering untrusted input through next/og ImageResponse remain affected, however. Netlify says the consequence there is a crashed function invocation—not code execution—though exploitation could increase function costs. Those are the host's assessments of its own platform.

The other critical flaw has no such hosting exemption. It affects App Router applications using Cache Components when a use cache function returns multiple typed arrays. Netlify describes the configuration as unusual but says applications meeting those conditions are vulnerable on its platform. The Next.js team says there is no known workaround and urges users to upgrade even if their applications do not contain similar functions.

The third vulnerability, rated high severity, lets crafted requests drive excessive CPU use in App Router applications with at least one Server Action, blocking other requests in the same process. Next.js says Pages Router applications and those without Server Actions are not vulnerable. Netlify says its autoscaling serverless architecture keeps a CPU-consuming request in one function from affecting other requests, while warning that exploitation could still raise customers' bills.

Redeploying the main site may leave older public versions exposed. Netlify warns that publicly accessible deploy previews and branch deploys can remain vulnerable until automatically deleted, and suggests removing them manually. Pantheon also places the update work with customers: its notice says they must update dependencies and redeploy, and that it does not update Next.js sites on their behalf.