Next.js v15.5.29 released with security fixes for three moderate advisories
Vercel published Next.js v15.5.29 on its GitHub releases page on 2026-11-03. The release includes security fixes for three moderate-severity advisories: cross-client response injection in self-hosted apps forwarding fetched responses, an SVG rejection bypass in image optimization, and HttpOnly cookie exposure via an internal response header on Edge runtime routes.
Why it matters
Self-hosted Next.js apps that proxy fetched responses, use image optimization with SVG handling, or run routes on the Edge runtime may be exposed to the listed issues until they upgrade to the patched version.
Who should care
Developers and agencies running self-hosted Next.js applications, sites using next/image, and teams deploying Edge runtime routes.
What you can do
Check your installed next version and upgrade to v15.5.29 or later, then review the linked advisories to confirm whether your app uses the affected features.