Vercel has issued security updates for Next.js to patch multiple vulnerabilities affecting image optimization, cache storage, and development servers. The fixes were delivered in versions 16.3.8 for Active LTS and 15.5.27 for Maintenance LTS following earlier delays caused by upstream dependency updates.
High-Severity Image Optimization SSRF
A high-severity Server-Side Request Forgery vulnerability tracked as CVE-2026-94483 affects Next.js image optimization. When remote allow-lists are configured, an attacker-controlled URL can trigger requests targeting internal IP ranges. Applications operating without configured remote patterns are not exposed to this flaw.
Cache Poisoning and Content Leaks
The updates address several medium-severity cache vulnerabilities across static generation and incremental rendering architectures. CVE-2026-94543 allows cache entry replacement on self-hosted Pages Router setups using SSG or ISR, causing incorrect content to serve until revalidation occurs. This issue does not impact deployments hosted on Vercel. Furthermore, CVE-2026-94484 permits an unauthenticated request to poison shared response caches on applications utilizing root-level catch-all routes alongside static features.
Projects utilizing experimental Cache Components also faced leaks. Nested cached functions could omit root parameters from cache keys, serving mismatched content across requests. Additionally, CVE-2026-94544 allowed unpublished Draft Mode preview content to leak into public cached responses when concurrent requests overlapped during cache fills.
Metadata Route Bypass and Dev Server Exposure
Additional fixes address App Router metadata images built with webpack (CVE-2026-94485), where dynamic segment boundaries were bypassed to generate excluded image routes; deployments built with Turbopack were unaffected. Finally, CVE-2026-94486 resolves an origin verification issue in the development server's Model Context Protocol endpoint that permitted malicious third-party websites to extract local file paths, route inventories, and code snippets during development sessions.
AI-generated editorial illustration; not a documentary photograph.
Source: September 2026 Security Release
SIGNAL TITANS
Leave a Reply