Next.js v15.5.28 released with security fixes for a critical RCE and a high-severity DoS
Vercel published Next.js v15.5.28 on its GitHub releases page on 2026-10-14. The release includes security fixes for a critical unauthenticated remote code execution issue in the Image Optimization API when SVG files are used, and a high-severity denial of service issue in the App Router involving Server Actions.
Why it matters
Projects running Next.js 15.5.x that use the Image Optimization API with SVG files or that expose App Router Server Actions are affected by these advisories. Upgrading to the patched release addresses both issues.
Who should care
Next.js developers, agencies and ecommerce brands running Next.js 15.x in production, and teams hosting self-managed Next.js apps.
What you can do
Upgrade the next package to v15.5.28 in your project and redeploy, prioritising sites that serve SVG images through next/image or use Server Actions.