Next.js v16.4.5 released with security fixes for seven advisories
Vercel published Next.js release v16.4.5 on GitHub on 2026-11-03. The release contains security fixes for seven advisories, all rated Moderate, covering the 'use cache' directive, Cache Components fallback shells, self-hosted response forwarding, SVG handling in image optimization, and cookie exposure on Edge runtime routes.
Why it matters
Applications running Next.js 16 that use 'use cache', Cache Components, self-hosted deployments, image optimization, or Edge runtime routes may be affected by the listed cache and disclosure issues, so upgrading to v16.4.5 addresses them.
Who should care
Teams and agencies running Next.js 16 in production, especially self-hosted deployments and sites using 'use cache', Cache Components, next/image, or Edge runtime routes.
What you can do
Upgrade the next package to v16.4.5 and redeploy, after checking the release notes for the specific advisories that apply to your app.