Next.js shipped 16.3.7 and 16.3.8 a day apart. Only one of them is the security release.

Vercel published Next.js 16.3.7 on 29 September. Its release notes say it is "backporting bug fixes" and list a single change to the Turbopack backend. There is no security section, no CVE and no advisory. It is an ordinary patch release that happened to land the day before a scheduled security release.

The security release came on 30 September, as 16.3.8 on the Active LTS line and 15.5.27 on Maintenance LTS. Vercel saw the confusion coming and added a dated note to its pre-announcement saying that 16.3.7 "does not include the security fixes planned for September 30" and that those fixes were now expected in 16.3.8 and 15.5.27.

If you run automated dependency updates, there is a reasonable chance a bot opened a pull request for 16.3.7 on 29 September, someone merged it, and the team now believes it has patched. It has not. The check is one command: confirm the installed version is 16.3.8 or later, not merely newer than what you had.

This is the detail most coverage flattens. The release post lists both versions in one sentence, which reads as though they are equivalent. They are not.

The release notes for 16.3.8 cover all seven issues: one high, five moderate and one low. The release notes for 15.5.27 list three, covering the metadata image route bypass and the two cache poisoning issues. The high severity server-side request forgery fix is not among them.

So "we are on the latest 15.5" does not mean what a 16.x reader would assume it means. If you are on 15.5 and you use Image Optimization with remote patterns, you should find out from Vercel what your position is rather than inferring it from a release post that was written about two lines at once.

The headline issue is CVE-2026-94483, advisory GHSA-cjq9-62q9-8jv4, server-side request forgery in Image Optimization, rated high at CVSS 8.3. The advisory describes an attacker-controlled, allow-listed remote URL leading to requests against internal addresses during image optimization.

The exemption is unusually clean, and it is the first thing to check: the release post says that if no images.remotePatterns are configured, your application is not affected. If that config is populated, the advisory tells you to audit the allow-listed hosts for any whose DNS entries you do not control, because that is the route in.

The rest divide into cache correctness problems and one development-only leak. Two concern cache poisoning of statically generated and incrementally regenerated pages, one is a metadata image route bypass, one leaks across root parameter values in nested use cache, one lets Draft Mode content reach a regular response, and one exposes a Model Context Protocol endpoint in the development server.

Each of these carries its own scoping sentence, and they do not combine into a general exemption for anyone.

Eight days earlier, Vercel shipped an out-of-band fix for CVE-2026-94545, a critical remote code execution issue in the Node.js ImageResponse implementation of next/og, rated 9.5. Its affected range is 16.2.0 up to but not including 16.3.6.

One correction worth making, because it was widely reported wrongly: Next.js 15.x was never affected by that remote code execution issue. Vercel's post says so directly and labels the 15.5.26 release as hardening only. If you are on 15.x, that critical was never yours.

If you are on 16.2.x, you are inside both windows. You need 16.3.8, which is the newest release on the 16.3 line and covers the 22 September critical and the 30 September seven together. Stopping at 16.3.6 leaves the seven, and stopping at 16.3.7 leaves everything.

The release was originally scoped at nine vulnerabilities. A note dated 30 September on the pre-announcement says it "now addresses seven vulnerabilities instead of nine. The remaining two (one critical, one high) are pending upstream coordination and will be addressed in a later Next.js release." The release post gives the reason as upstream dependency delays.

That means upgrading to 16.3.8 does not close the book. A critical issue is known to exist and is unpatched as of 2 October, with no CVE, no advisory, no affected range and no target date published. We are not going to speculate about which component it touches, because nothing published supports a guess.

The actionable version of this is operational rather than technical. The last two Next.js criticals both came from upstream dependencies, and the stated reason for the delay is upstream coordination, so a dependency-level fix may surface before the Next.js release does. If your release process needs a day of QA before a framework bump can ship, that path is worth shortening now rather than during the next unscheduled patch.

If you go looking at the advisories yourself to build a precise version matrix, you will hit something odd. Six of the seven advisory pages publish a placeholder where the patch digit should be, rendering as 16.3.? and 15.5.?, and two list an affected range starting at 16.0.0 despite a fix shipping on the 15.5 line.

We are therefore not publishing per-issue affected ranges, and we would suggest you do not build tooling on them this week either. The reliable instruction is the simple one: 16.3.8 on the 16.x line, 15.5.27 on the 15.5 line.