--- title: September 2026 Security Release | daily.dev description: Next.js has released patched versions v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) addressing multiple security vulnerabilities, including a... canonical: https://daily.dev/posts/september-2026-security-release-z46gampdn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: September 2026 Security Release | daily.dev og:description: Next.js has released patched versions v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) addressing multiple security vulnerabilities, including a... og:url: https://daily.dev/posts/september-2026-security-release-z46gampdn og:image: https://api.daily.dev/og/posts/Z46GAmpdn.png og:image:alt: September 2026 Security Release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # September 2026 Security Release **[Next.js](https://daily.dev/sources/next)** · 4 min read · 2 upvotes · 0 comments ## Summary Next.js has released patched versions v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) addressing multiple security vulnerabilities, including a high-severity SSRF in Image Optimization and several medium-severity cache poisoning issues affecting SSG/ISR pages, cross-user content substitution, and Draft Mode content leakage. Also patched: an information disclosure bug in App Router metadata image routes (webpack builds only) and a low-severity issue exposing sensitive development data via the dev server's Model Context Protocol endpoint. Developers are urged to upgrade immediately via npm install. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What version of Next.js fixes the SSRF vulnerability in Image Optimization, CVE-2026-94483? Next.js v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) fix this high-severity SSRF vulnerability, tracked as CVE-2026-94483 / GHSA-cjq9-62q9-8jv4. An attacker-controlled, allow-listed remote URL can force server-side requests to private IP ranges during Image Optimization. Applications without images.remotePatterns configured are not affected. Upgrade with npm install next@16.3.8 or next@15.5.27. _Teams patching image optimization risks can track Next.js security releases like this on daily.dev._ ### Does the Next.js cache poisoning vulnerability CVE-2026-94543 affect apps hosted on Vercel? No, applications deployed on Vercel are not affected. This medium-severity cache poisoning issue only impacts self-hosted Next.js applications using the Pages Router with SSG or ISR pages, where a cache entry can be replaced with content from a different route, serving wrong content to every visitor until the entry is revalidated. It is fixed in v16.3.8 and v15.5.27. _Developers self-hosting Next.js can keep up with cache-poisoning fixes like this via daily.dev._ ### What data can be exposed through the Next.js dev server's Model Context Protocol endpoint vulnerability CVE-2026-94486? A malicious website visited by a developer can read the project's disk location, source code snippets from error reports, the route inventory, and development logs, because next dev exposes an MCP endpoint that does not verify the request's origin. Only next dev is affected; production deployments do not serve this endpoint. It is fixed in Next.js v16.3.8 and v15.5.27. _Developers running next dev locally can follow disclosures like this to protect their workflow on daily.dev._ ## Similar posts on daily.dev - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments - [Upcoming Next.js September Security Release](https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c) · Next.js · 19 upvotes · 3 comments - [Upcoming Next.js Security Update for a Critical Upstream Issue](https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago) · Next.js · 11 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/september-2026-security-release-z46gampdn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"September 2026 Security Release","url":"https://daily.dev/posts/september-2026-security-release-z46gampdn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/september-2026-security-release-z46gampdn"},"datePublished":"2026-09-30T17:00:27.899Z","dateModified":"2026-09-30T17:00:51.866Z","description":"Next.js has released patched versions v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) addressing multiple security vulnerabilities, including a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd0c52906e0b5134530b4a3af30363b5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd0c52906e0b5134530b4a3af30363b5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Next.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Next.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a7460ee33d92486cb5afd0fca36a116d","url":"https://daily.dev/sources/next"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/september-2026-security-release-z46gampdn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nextjs,vercel","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Next.js","item":"https://daily.dev/sources/next"},{"@type":"ListItem","position":3,"name":"September 2026 Security Release"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/september-2026-security-release-z46gampdn#faq","mainEntity":[{"@type":"Question","name":"What version of Next.js fixes the SSRF vulnerability in Image Optimization, CVE-2026-94483?","acceptedAnswer":{"@type":"Answer","text":"Next.js v16.3.8 (Active LTS) and v15.5.27 (Maintenance LTS) fix this high-severity SSRF vulnerability, tracked as CVE-2026-94483 / GHSA-cjq9-62q9-8jv4. An attacker-controlled, allow-listed remote URL can force server-side requests to private IP ranges during Image Optimization. Applications without images.remotePatterns configured are not affected. Upgrade with npm install next@16.3.8 or next@15.5.27. Teams patching image optimization risks can track Next.js security releases like this on daily.dev."}},{"@type":"Question","name":"Does the Next.js cache poisoning vulnerability CVE-2026-94543 affect apps hosted on Vercel?","acceptedAnswer":{"@type":"Answer","text":"No, applications deployed on Vercel are not affected. This medium-severity cache poisoning issue only impacts self-hosted Next.js applications using the Pages Router with SSG or ISR pages, where a cache entry can be replaced with content from a different route, serving wrong content to every visitor until the entry is revalidated. It is fixed in v16.3.8 and v15.5.27. Developers self-hosting Next.js can keep up with cache-poisoning fixes like this via daily.dev."}},{"@type":"Question","name":"What data can be exposed through the Next.js dev server's Model Context Protocol endpoint vulnerability CVE-2026-94486?","acceptedAnswer":{"@type":"Answer","text":"A malicious website visited by a developer can read the project's disk location, source code snippets from error reports, the route inventory, and development logs, because next dev exposes an MCP endpoint that does not verify the request's origin. Only next dev is affected; production deployments do not serve this endpoint. It is fixed in Next.js v16.3.8 and v15.5.27. Developers running next dev locally can follow disclosures like this to protect their workflow on daily.dev."}}]} ```