Next.js and Vercel: the 2026 security updates (not a breach)
Next.js is the React framework maintained by Vercel and widely used for server-rendered sites. When React Server Components or its caching have a flaw, Next.js apps are where it shows up. This page tracks the Next.js security updates of autumn 2026 and keeps them apart from any claim of a breach.
Short answer
Was Vercel hacked?
No breach of Vercel is reported in the sources we read. What is reported are vulnerabilities in Next.js. On 14 October 2026 the Next.js team published a security update for upstream vulnerabilities, including an advisory it titles unauthenticated remote code execution in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr, critical), fixed in 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). It says there is no known workaround.
The post cites the React advisory GHSA-xqc2-xf4c-x3h3 as related upstream and does not print its CVE ID or say which earlier Next.js versions are affected. A November 2026 release (16.4.5 and 15.5.29, published 3 November) lists other issues.
Timeline at a glance
14 Oct 2026Next.js security update: use cache RCE (GHSA-673q-mjm6-r5xr) fixed in 16.4.1 and 15.5.28; related to the React advisory. (Next.js)Confirmed
3 Nov 2026Next.js November security release: versions 16.4.5 and 15.5.29. (Next.js)Confirmed
Last updated 11 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Vercel (Next.js) incident timeline, in detail
Confirmed = acknowledged by Vercel (Next.js), a regulator filing or a court. Reported = credible reporting Vercel (Next.js) has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Oct 2026Not a breachProduct vulnerability
Critical RCE in use cache functions returning typed arrays
What happened. The Next.js post says applications using the App Router with Cache Components can be exposed to unauthenticated remote code execution when a use cache function returns multiple typed arrays. Fixed in 16.4.1 and 15.5.28. The same post covers other issues, including a critical Image Optimization flaw with SVG files (GHSA-2464-fhr4-w9xw).
Impact. The post says there is no known workaround for affected applications. It does not state the affected version range.
What happened. Next.js published fixed versions 16.4.5 and 15.5.29 on 3 November 2026 for cache and SVG issues. The post does not mention React Server Components.
Impact. Customers on older lines need to move to a fixed release on their line.
The Next.js update does not name CVE-2026-126187 or say which Next.js versions are affected; the link to the React advisory is its own wording ("related upstream advisory").
The Vercel advisories list on GitHub did not show GHSA-673q-mjm6-r5xr on the first page when we read it, so the Next.js blog post is our source for it.
The pattern across the record
Framework flaws arrive through upstream packages
The October fix came with an upstream React advisory, so teams need to watch both the framework and its React packages.
Vulnerabilities are not breaches
No source reports an intrusion at Vercel. The exposure is to apps on affected Next.js versions.
What it means for Vercel (Next.js) customers — and what to do
If you run Next.js with the App Router, check your version against the fixed releases.
1.Check your Next.js version
Move to 16.4.1 or later on the 16 line, or 15.5.28 or later on the 15 line, and check the November release too.
2.Check the React packages
Confirm the react-server-dom versions in your lockfile against the React advisory.
No breach of Vercel is reported. The 2026 stories are vulnerabilities in the Next.js framework.
Which Next.js versions fix the October RCE?+
16.4.1 on the 16 line and 15.5.28 on the 15 line, per the Next.js post. The November release adds 16.4.5 and 15.5.29.
Is there a workaround?+
The Next.js post says there is no known workaround for affected applications.
Does it affect apps without the App Router?+
The post describes the flaw as affecting applications using the App Router with Cache Components where a use cache function returns multiple typed arrays. It does not state a wider range.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Vercel (Next.js). Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.