Next.js 16.1 Security Patches: CVEs Explained 2026

TL;DR

Upgrade affected applications to the latest patched release in the reader's supported line. Keep each CVE's scope separate. The original RSC remote-code-execution advisory, the follow-up denial-of-service and source-exposure advisories, and the January 2026 denial-of-service chain have different affected ranges. Hosting-provider controls are temporary mitigations, not substitutes for upgrading.

Key takeaways

• CVE-2025-55182 and CVE-2025-66478 concern the vendor-described React Server Components and Server Function deserialization boundary and remote-code-execution impact.
• CVE-2025-55184, CVE-2025-67779, and CVE-2026-23864 concern denial-of-service impact in their documented ranges.
• CVE-2025-55183 concerns source-code exposure.
• The advisories require upgrading affected applications; treat any temporary mitigation only as defense-in-depth, not a substitute for upgrading.
• Pricing is out of scope. This guide covers upstream vulnerability scope and patched package lines, not deployment plans.

Package health snapshot

At access time, the npm records listed the next package at 16.3.2, the react package at 19.2.8, and the react-dom package at 19.2.8.

For the January 2026 CVE-2026-23864 RSC denial-of-service chain, the official safe React backports are 19.0.4, 19.1.5, and 19.2.4. GHSA-h25m-26qc-wcjf lists stable patched Next.js releases beginning at 15.0.8: 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 16.0.11, and 16.1.5. Next.js 14.2.35 belongs to the separate December 2025 CVE-2025-55184/CVE-2025-67779 follow-up guidance; do not present it as a January 2026 CVE-2026-23864 patch. Use the latest patched release in the reader's supported line rather than treating one historical patch as a universal pin.

Comparison matrix: vulnerability scope

CVE-2025-66478 affects documented Next.js 15.x and 16.x App Router RSC deployments plus specified canaries. Stable Next.js 13 and 14, Pages Router, and Edge Runtime were not affected by that RCE. The later denial-of-service and source-exposure advisories have broader version ranges, which is why each CVE's scope must remain separate.

What the advisories establish

The official React and Next.js advisories describe an unsafe deserialization boundary in React Server Components and Server Functions. They establish the security impact and affected versions without requiring application authors to reproduce exploit internals. Remediation means upgrading to patched React and Next.js lines.

Do not infer exposure solely from the presence or absence of one application feature. Inventory the actual package versions, router mode, runtime, and advisory range. If an application falls inside an affected range, treat the upgrade as required.

Migration notes: upgrade and verification

bun update next react react-dom
bun pm ls next react react-dom
bun audit

For npm-managed applications, use the equivalent npm update and npm ls commands. In a monorepo, inspect every workspace and resolved dependency tree rather than only the root manifest.

Use this rollout sequence:

1. Record the current Next.js, React, and React DOM versions in every deployable workspace.
2. Map each version to the relevant advisory range.
3. Upgrade to a current patched release within each supported line.
4. Run application tests and exercise App Router, Server Functions, and error paths.
5. Deploy through the normal change-control path and verify the resolved production build.

Official advisories and npm endpoints were reachable on 2026-08-22. Upgrade affected applications. Hosting-provider controls may reduce exposure while the upgrade is prepared, but temporary mitigations do not prove that the application is safe.

Security notes

Temporary mitigations may reduce exposure while an upgrade is prepared, but they do not repair vulnerable framework code. Upgrade affected applications and verify the resolved package versions.

Under specific conditions, error messages in the RSC protocol could include stack traces or internal file paths that reveal the server's directory structure. This is a medium-severity information disclosure, not directly exploitable for code execution, but useful for reconnaissance ahead of a more targeted attack.

The Next.js team has committed to a responsible disclosure process and maintains a security advisory channel. Subscribe to the vercel/next.js GitHub repository's security advisories to get notifications directly, rather than relying on npm audit to pick up disclosures after the fact.

Methodology

Primary evidence comes from the official React and Next.js security posts, the GitHub advisory for the January 2026 denial-of-service issue, and exact npm package records. These sources establish severity and affected versions, not prevalence or provider guarantees.

FAQ

Which version should I install?

Install the latest patched release in the application's supported line. The frozen package snapshot records current package tags, while the advisories record the minimum patched lines for their specific vulnerability chain.

Are Pages Router applications affected?

The original CVE-2025-66478 RCE advisory excludes Pages Router, but later advisories use different ranges. Check the specific advisory rather than carrying one exclusion across every CVE.

Can a provider mitigation replace the upgrade?

No. Provider controls are temporary mitigations. Upgrade affected applications and verify the resolved production packages.

Sources

The synchronized guide packet contains the approved official source catalog, exact accessed date, and assertion mapping.

Related guides

• Best Next.js authentication solutions
• Next.js 15 vs Remix v2
• Partial prerendering in Next.js