November 2026 opened with a scheduled Next.js security release, days after Node.js 26 moved to long-term support. Here is what matters for a product owner and their team.
Next.js: seven vulnerabilities closed (3 November)
The Next.js team released 16.4.5 and 15.5.29. Version 16.4.5 closes all seven issues, and 15.5.29 closes the three that affect the 15 line. The Next.js blog rates one issue High and the rest Medium.
- Cross-tenant data disclosure when unstable_cache and use cache are combined. This is the High issue, and it matters for platforms serving several clients from one app.
- Two more Cache Components issues that can show cached content to the wrong person.
- Poisoned cached shells on self-hosted next start apps, in a specific route setup.
- HttpOnly cookie values exposed in an internal header on Edge routes. Exploiting it needs attacker-controlled JavaScript on the same origin.
- Responses mixed between visitors on self-hosted apps behind certain reverse proxies.
- A bypass of the SVG block in image optimization, limited to permitted image sources.
Node.js 26 is now LTS (28 October)
The Node.js 26 line entered long-term support with 26.13.0, codenamed Lithium, and will receive updates until the end of April 2029. Lines 22 and 24 are still listed as LTS on the official releases page.
The release schedule itself is changing. From Node.js 27 there will be one major release a year, in April, and every release becomes LTS that October. The first under this model is 27.0.0, planned for April 2027, and the schedule may still be amended.
What to do now
- Ask your team which Next.js version is actually deployed, not just the one on a developer's machine.
- Update to the patched version, then check sign-in, forms and payments.
- If your site serves several clients or uses Cache Components, review cached data after updating.
- For new projects, choose Node.js 26, the current line with the longest support.