Next.js 16.3 vulnerabilities: which version is patched?

Next.js has published a lot of security fixes since July, and the version numbers don’t make it obvious which release actually has them. The worst case is 16.3.7: it came out on September 29, the day before a scheduled security release, and it’s a bug-fix release only. Next.js’s own announcement says so.

So I took one small App Router app (an image, a server action, a next/og route and middleware: the features the advisories touch) and ran npm audit and next build on it at each step.

What npm audit says at each version

npm i next@16.3

The only warning on every version was one that has nothing to do with security: The "middleware" file convention is deprecated. Please use "proxy" instead. It’s printed on 16.3.0 too, so it isn’t something the upgrade added.

Which release fixed what

From the published advisories for the 16.3 line:

The September 30 announcement also says two more issues, one critical and one high, are “pending upstream coordination and will be addressed in a later Next.js release”. So today’s patched release won’t be the last one you need. npm audit can only flag what’s been published.

I tested the 16.x line only. The 15.x versions above come from the advisories.

npm audit fix doesn’t do what you’d expect

The obvious fix behaved differently depending on how next was written in package.json:

The exact pin isn’t unusual: create-next-app@16.3.0 writes "next": "16.3.0" exactly. So on a freshly scaffolded project, npm audit fix leaves every advisory in place, and the forced version quietly removes the pin you had. npm update next on a caret range also went to 16.4.0.

next upgrade crashes on Windows

Next.js has its own upgrade command, and on Windows it failed immediately, from PowerShell and from Git Bash:

$ npx next upgrade --revision 16.3.8
Error: spawn npx ENOENT
    at onErrorNT (node:internal/child_process:484:16)
  ...
  spawnargs: [ '--yes', '@next/codemod@canary', 'upgrade', '16.3.8' ]

It’s reported upstream (vercel/next.js#97980). The fix (#98075) was still unmerged when I tested, and 16.4.0’s next upgrade crashed the same way.

npx --yes @next/codemod@canary upgrade 16.3.8

What’s new in 16.4.0

16.4.0 came out on October 6. From its release notes: next dev and next build now nudge you when your version has known security issues, next upgrade --ai adds vulnerability coverage, and the Pages Router deprecates React 18. I only built the test app on it (it passed); I didn’t test the nudges or the AI upgrade.

What didn’t work

How this was tested

One App Router app (TypeScript, next/image, a server action, a next/og route, a middleware file) on Windows 11 with Node 24.14.0 and npm 11.9.0. For each of next 16.3.0, 16.3.7, 16.3.8 and 16.4.0: npm audit --json (counting the advisories listed under next) and next build (Turbopack). Then npm audit fix, npm audit fix --force, npm update next and a direct install of the 16.3 line, each starting again from 16.3.0, with both caret and exact versions in package.json. Severities and counts are npm’s on October 8, 2026, and will change as new advisories are published. I didn’t test the vulnerabilities themselves, the Pages Router, custom servers or the 15.x line.

The code for every case above is public, so you can run it yourself: next-security in nk-repro.