Next.js 16.2–16.3.5 has a critical bug
Many sites auto-generate link preview images with text from the URL, like a page title. On the affected versions, an attacker can hide malicious code in that text and run it on your server.
Update to 16.3.6 now
An out-of-band Next.js security update is planned for September 22, 2026.
It addresses a critical issue in an upstream dependency. Upgrade to Next.js 16.3.6 or 15.5.26 as soon as they are available.
nextjs.org/blog/upcoming-nex…
Sep 22, 2026 · 6:12 PM UTC
130