Next.js v16.4.1 released with security fixes for three advisories
Vercel released Next.js v16.4.1 on 2026-10-14 containing security fixes for two critical advisories (unauthenticated remote code execution in use cache functions returning typed arrays, and in the Image Optimization API when SVG files are used) and one high-severity advisory (denial of service in App Router using Server Actions).
Why it matters
Two critical unauthenticated remote code execution issues and one high-severity denial of service issue are patched in this release. Sites running affected Next.js versions with use cache, the Image Optimization API, or Server Actions are exposed until they upgrade.
Who should care
Developers and agencies running Next.js applications, ecommerce brands on Next.js storefronts, hosting and DevOps teams
What you can do
Upgrade Next.js to v16.4.1 in every production project and redeploy, then review the release notes for the specific advisory IDs that apply to your app.