Next.js security update: a beginner patch-and-verify lab

What changed in Next.js on 22 September 2026

The Next.js team published an out-of-band security update on 22 September 2026. Its official announcement says Next.js 16.3.6 is the patched Active LTS release and 15.5.26 is the Maintenance LTS hardening release. The issue is associated with upstream dependencies used by the Node.js implementation of ImageResponse from next/og.

The project advisory lists Next.js versions from 16.2.0 up to, but not including, 16.3.6 as affected. It explains that the risky condition involves attacker-controlled values being placed into SVG content, attributes or styles during Node.js image generation. Edge ImageResponse and applications that do not pass attacker-controlled values into those SVG locations are described as unaffected by this issue.

Source: Next.js: Security Update for a Critical Upstream IssueNext.js security advisory: Remote Code Execution in next/og ImageResponse

Do not turn a version range into panic

Start with an inventory. Record the version resolved by the lockfile, not only the range written in package.json. Then search the project for ImageResponse and next/og. If the feature is present, trace where every value inside generated SVG content comes from. User-controlled input can include query parameters, form values, imported records or API responses that an attacker can influence.

Exposure analysis does not replace patching when the maintainer recommends an upgrade. It tells the team what should be tested and whether temporary mitigation is needed. The official advisory says that, when immediate upgrading is impossible, attacker-controlled values should not be passed into affected SVG content, attributes or styles. Treat that as a temporary constraint, not permission to forget the dependency.

Source: Next.js security advisory: Remote Code Execution in next/og ImageResponse

A patch release still needs a controlled workflow

Create a focused branch or disposable practice copy. Confirm the application builds before changing dependencies, update the intended Next.js release, and inspect both package.json and the lockfile. A small version change can update transitive packages, so the lockfile diff is part of the review rather than generated noise to ignore.

Run the same checks used before deployment: type checking, unit tests, a production build and a short browser journey through important routes. If the application generates Open Graph images, test a normal image request and inputs containing characters that require escaping. Do not publish exploit code or probe systems you do not own; the learning goal is safe verification on your own local project.

Source: Next.js: Security Update for a Critical Upstream IssueNext.js documentation: Upgrade Guides

Complete the dependency response lab

Use a small Next.js practice application or analyse its files without deploying it. Write a one-page patch record that another developer could follow. The record should distinguish facts from assumptions and link directly to the maintainer announcement and advisory rather than relying on a social-media summary.

If you cannot perform the upgrade, complete the inventory and test plan instead. Never change a production dependency merely to finish a tutorial. A real team may need compatibility review, staged deployment, rollback preparation or approval from the application owner.

• Record the resolved Next.js version and the command or lockfile line that proves it.
• Search for next/og and ImageResponse; document whether Node.js or Edge execution is used.
• Identify whether untrusted data can reach generated SVG content, attributes or styles.
• Update only through the project’s package manager and review the complete dependency diff.
• Run type checking, tests, a production build and one relevant image-generation check.
• Record the deployment identifier, production version evidence and a rollback point.

Source: Next.js security advisory: Remote Code Execution in next/og ImageResponseNext.js documentation: Upgrade Guides

The next announced release is not available yet

On 23 September, the Next.js team also announced a scheduled security release for 30 September 2026. The notice says planned versions 16.3.7 and 15.5.27 will address nine vulnerabilities, with full advisories and upgrade instructions to be published with the release. Those versions should not be described as available before the maintainer actually publishes them.

The practical response is to patch the currently disclosed issue now, note the upcoming maintenance date and review the official page again after release. Avoid guessing which applications are affected by unpublished details. Advance notice helps teams reserve testing time; it is not evidence for claims beyond what the announcement states.

Source: Next.js: Upcoming September Security Release

What this update should change in your learning plan

Framework learning should include maintenance, not only feature development. Practise reading semantic version ranges, following a dependency from direct package to transitive component, testing a patch and writing a short change record. These habits remain useful when the specific framework or advisory changes.

For a portfolio, include the redacted patch record, validation commands and a brief explanation of why checking feature usage matters. Learners in Chennai or online can use this exercise alongside SPOTHUB’s Full Stack Development + AI learning path. It demonstrates a review process, not professional security certification, and training does not guarantee employment or a particular outcome.

Sources and further reading

• Next.js: Security Update for a Critical Upstream Issue · checked 2026-09-24
• Next.js security advisory: Remote Code Execution in next/og ImageResponse · checked 2026-09-24
• Next.js: Upcoming September Security Release · checked 2026-09-24
• Next.js documentation: Upgrade Guides · checked 2026-09-24

Spot an error? Email info@spothub.in with the article link and correction.