Is My Next.js Version Vulnerable? How to Check and Fix

To find out whether your Next.js version is vulnerable, check the version your app actually installs, not the range in package.json, and compare it with the fixed versions in the Next.js security advisories. As of 27 October 2026, the latest advisories, published on 14 October, are fixed in Next.js 16.4.1 and 15.5.28. Any 16.x release from 16.4.1 or any 15.x release from 15.5.28 includes every 2026 fix that names a fixed version on those lines.

How to check your Next.js version

1. Ask the Next.js CLI. In the project folder, run npx next --version. The Next.js CLI reference documents -v or --version as the option that outputs the Next.js version number.
2. Ask the package manager what is installed. Run npm ls next. It shows the version resolved in node_modules, including any second copy pulled in by another package.
3. Read the lockfile. In package-lock.json, the node_modules/next entry holds the version your builds install. A range such as ^16.3.8 in package.json allows any 16.x release from 16.3.8; the lockfile decides what CI and production get.
4. Check every deployed copy. Run the same check in each production image, CI runner and preview environment. They can lag behind your laptop if a lockfile change has not been deployed.

Which Next.js versions include the fixes?

Next.js publishes its advisories on GitHub. Across 2026, every advisory that names a stable fixed version on the 16.x or 15.x line names one at or below 16.4.1 or 15.5.28. Six advisories from 30 September 2026 do not yet name a fixed version on GitHub, including two cache poisoning issues that affect 15.x (GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p). These are the critical advisories:

The October fixes are covered in detail in our post on the Next.js RCE vulnerability. The npm latest tag points to 16.4.3, which is newer than both fixed releases.

What if I am on Next.js 14 or older?

The Next.js support policy lists 16.x as Active LTS and 15.x as Maintenance LTS; 14.x and every earlier major are listed as unsupported. No 2026 advisory names a fixed version on 14.x or older, even where an advisory's affected range starts at 10.0.0 or 13.0.0. An app on 14.x or older therefore needs a major upgrade to receive these fixes. The policy also says each major stays in Maintenance LTS for two years after its initial release, and lists 15.x as released on 21 October 2024, so plan the move to 16.x as well.

How to fix a vulnerable Next.js version

1. Upgrade within your line. Run npm install next@16.4.1 (or next@latest) on 16.x, or npm install next@15.5.28 on 15.x. Staying on your major is the smallest change.
2. Confirm the result. Run npm ls next again and check that the lockfile now records the new version.
3. Rebuild and redeploy everything. Commit the lockfile, rebuild every image and restart every server. A running process keeps the old code until it restarts.
4. Test the risky paths. Exercise pages that use next/image, Server Actions, middleware or proxy rules, and any cached functions before closing the ticket.

Does a static export need the patch?

The Next.js static export guide says features that need a Node.js server are not supported with output: 'export', including Image Optimization with the default loader, Server Actions, Proxy and Incremental Static Regeneration. Many of the server features named in the advisories are therefore not available in a fully static site. Upgrade anyway: the build still runs the Next.js toolchain, and a later switch to a server deployment would bring the vulnerable code paths back.

What to do next

Run npx next --version and npm ls next in every Next.js project today, and move anything below 16.4.1 or 15.5.28. If the same stack runs Node.js, the Node.js Brotli RCE fix needs the same check. Our ecommerce supply chain security checklist covers lockfiles and patch routines, and our headless Shopify development team can run the upgrade and test it for you.