- Next.js released patches for seven medium‑severity security vulnerabilities in versions 16.4.5 and 15.5.29 on November 3 2026.
- Vulnerabilities involve cache leaks, cache poisoning, HttpOnly cookie exposure, and cross‑client response injection affecting Cache Components, Edge routes, and image optimization.
- Netlify users should upgrade Next.js to the patched version and update the @netlify/plugin‑nextjs adapter to v5.16.6, then redeploy to clear affected caches.