# Next.js September 2026 security fixes in 16.3.8 and 15.5.27

Canonical source : [Next.js September 2026 security fixes in 16.3.8 and 15.5.27](<https://sebastien.rigaux.be/en/tech-watch/links/link-64ebab624a7f5858-en>)

Next.js releases 16.3.8 and 15.5.27 to address several vulnerabilities, including image optimization SSRF and cache poisoning issues. The advisory identifies affected configurations to help teams prioritize the update.

- Selected on : 2026-10-13

- Resource publication : 2026-09-30

- Entry updated : 2026-11-07T20:32:37+0000

- Format : Release

- Source language : EN

- Credit : Sebastian Silbermann, Josh Story et Karim Rahal

Original resource : [Next.js September 2026 security fixes in 16.3.8 and 15.5.27](<https://nextjs.org/blog/september-2026-security-release>)

Tags : [Next.js](<https://sebastien.rigaux.be/en/tech-watch/tags/nextjs>) · [Security](<https://sebastien.rigaux.be/en/tech-watch/tags/security>)

Available versions : [English](<https://sebastien.rigaux.be/en/tech-watch/links/link-64ebab624a7f5858-en>)

[Back to tech watch](<https://sebastien.rigaux.be/en/tech-watch>)