Next.js latest safe version: 16.4.1+ or 15.5.28+

As of October 23, 2026, the safe Next.js versions are 16.4.1 or later on 16.x (16.4.3 is the newest) and 15.5.28 on 15.x, the first releases fixing the critical unauthenticated RCEs disclosed on October 14; no 16.3.x or 14.x release is patched. Upgrade with npm install next@16.4.3 (or next@15.5.28 on 15.x), then confirm npm ls sharp shows 0.35.5 or later.

Last checked: 2026-10-23, against nextjs.org, the vercel/next.js security advisories and the npm registry. Next.js pre-announces security releases roughly once a month and ships urgent fixes out of band, so check this date before you trust the numbers below.

Which Next.js version is safe right now?

16.4.1 or later on Next.js 16, and 15.5.28 on Next.js 15. Those are the first releases patched for the October 14, 2026 security update. No security release has followed: 16.4.2 (October 15) and 16.4.3 (October 23) are bug-fix backports, and neither release note names an advisory.

The 16.3 line has no patched release at all. Active LTS moved from 16.3 to 16.4, the advisories cover every 16.x up to 16.4.0, and npm has no 16.3.9. If you pinned 16.3.8 because it was the patched version on September 30, it fell below the floor two weeks later.

What did the October 14 release fix?

Two critical RCEs and one high-severity denial of service:

• CVE-2026-96889 / GHSA-2464-fhr4-w9xw (Critical, CVSS 9.5): unauthenticated RCE in the Image Optimization API when SVG files are used and Next.js runs on glibc-based Linux, caused by a memory bug in an upstream library. It's the same optimizer that throws the "url" parameter is not allowed error. Affected: 10.0.0 through 15.5.27, and 16.x up to 16.4.0.
• GHSA-673q-mjm6-r5xr (Critical, CVSS 9.5, no CVE yet): unauthenticated RCE in App Router apps using Cache Components, when a use cache function returns multiple typed arrays. Affected: 16.0.0 through 16.4.0. There's no workaround.
• GHSA-p3m5-59mp-jv5r (High, CVSS 8.2): a CPU-exhaustion denial of service against any App Router app with at least one Server Action. Affected: 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0.

Don't skip the use cache fix because you don't use the feature. The advisory says: "You should upgrade immediately even if your application does not have similar functions."

How fast has the safe floor moved in 2026?

Five times in under three months. Next.js formalised a security release program in July 2026, and these are the releases since:

Five security releases between July 21 and October 14, 2026, three of them fixing critical-severity remote code execution. Each patched 16.x release stayed the floor for between eight days and five weeks.

So "safe" means "at or above the floor set by the latest release", and that floor moves every few weeks. Any next at today's floor is also well past the fix for the December 2025 React2Shell RCE and its affected versions. An exact pin that was right in September is wrong in October, which is how known-vulnerable dependencies slip past review.

What a scan of a September-patched project shows

This project pinned the freshly patched 16.3.8 on September 30:

{
  "name": "my-saas",
  "private": true,
  "dependencies": {
    "next": "16.3.8",
    "react": "19.2.8",
    "react-dom": "19.2.8",
    "@supabase/ssr": "^0.12.7",
    "@supabase/supabase-js": "^2.118.0"
  }
}

That's general/vulnerable-dependency at critical severity. The full finding names the three October advisories and asks for >= 16.4.1. GuardLayer rates a next finding critical only when the advisory setting the current floor is rated Critical by its publisher, as both October RCEs are. A critical finding fails the GuardLayer check under the default policy. It blocks merges only if you make that check a required status check in branch protection.

Two limits. The rule reads the version in package.json, not your lockfile, so a caret range like ^16.3.8 gets a note asking you to confirm what resolved. And it never sees a transitive sharp.

Upgraded to 15.5.28 and still exposed? Check sharp

The SVG RCE lives in librsvg, which sharp bundles, not in Next.js code. sharp's own advisory, GHSA-wq5f-xc86-pv6w, lists every sharp release below 0.35.5 as affected. The Next.js advisory's workaround: make sure the sharp it uses is 0.35.5 or later.

On 16.x that happens on its own: next@16.4.1 declares its optional sharp dependency as ^0.35.5. next@15.5.28 declares ^0.34.3 || ^0.35.5, so a sharp 0.34.x already in your lockfile still satisfies it. We tested this with npm 11.12.1 (not pnpm or yarn). A lockfile created on next 15.5.21 resolved sharp 0.34.5. After npm install next@15.5.28, it still held 0.34.5. One more command fixed it:

npm ls sharp        # anything below 0.35.5 is in the affected range
npm update sharp    # moved 0.34.5 -> 0.35.5 in our test
npm ls sharp

A fresh 15.5.28 install picked 0.35.5 by itself, as the advisory says fresh installs do; the upgrade path is the gap. GuardLayer flags a sharp below 0.35.5 only when it's a direct dependency in package.json. The transitive case is yours to check.

Is Next.js 15 still supported?

Officially yes, for now: nextjs.org still lists 15.x as Maintenance LTS, but by Next.js's own two-year rule that window ended on October 21, 2026. The support policy keeps a major in Maintenance LTS "for two years following the initial release", and lists 15.x as released on October 21, 2024. There's no end-of-support notice yet, and the policy allows rare, severity-driven patches outside LTS.

Read that as: 15.5.28 may be the last scheduled 15.x security release. Get to 15.5.28 today, then plan the move to 16. Budget for the middleware.ts to proxy.ts rename while you're at it.

Next.js 14 is already on the unsupported list. The SVG advisory's affected range starts at 10.0.0, and there's no 14.x fix.

A 60-second self-check

npm ls next               # floor: 16.4.1 on 16.x, 15.5.28 on 15.x
npm ls sharp              # floor: 0.35.5
npm view next dist-tags   # today: latest = 16.4.3, backport = 15.5.28

If next is below the floor, upgrade within your line today. The October 14 post doesn't ask you to rotate secrets, but an unauthenticated RCE means code could have run in your server process. If a vulnerable build was internet-facing, use the rotation order from the React2Shell post.

FAQ

What is the latest safe version of Next.js? 16.4.3 is the newest release as of October 23, 2026, and any 16.x from 16.4.1 up clears every Next.js security release to date. On 15.x, 15.5.28 is both the newest and the only safe release.

Is Next.js 16.3.8 safe? No. It was the patched release on September 30, but both October RCEs affect it, and there is no 16.3.x fix. Move to 16.4.1 or later.

Is Next.js 15 end of life? Not officially yet. The support page still lists 15.x as Maintenance LTS, but the policy's two-year window ran out on October 21, 2026. Treat 15.5.28 as possibly the last 15.x patch and plan the move to 16.

Is Next.js 14 safe to use? No. 14.x is unsupported, and no 14.x release is patched for the October SVG RCE. Upgrade to 15.5.28 at minimum, and to 16 if you can.

Do I need to upgrade if I don't use use cache or SVG images? Yes. The use cache advisory says to upgrade even without such functions, and the DoS hits any App Router app with at least one Server Action.

Do 16.4.2 and 16.4.3 contain security fixes? No. Both release notes list bug-fix backports and name no advisory. 16.4.1 is still the first patched 16.x release, but if you're upgrading now, take 16.4.3.