Next.js shipped v16.4.1 and v15.5.28 with fixes for three advisories, and the two critical ones need no account at all - the requests just have to reach the server.
What the advisories are
GHSA-673q-mjm6-r5xr - critical. Unauthenticated remote code execution through use cache functions that return multiple typed arrays. It needs App Router with Cache Components and a matching function, but the advisory says to upgrade immediately even if nothing in your app looks like that.
GHSA-2464-fhr4-w9xw - critical. Unauthenticated remote code execution in the Image Optimization API when SVG files are used. The flaw is a memory issue in the upstream image library, and Next.js on glibc-based Linux is the exposure. The workaround is the interesting part - the advisory names sharp 0.35.5 as the fixed version.
GHSA-p3m5-59mp-jv5r - high. Crafted requests against an App Router app with at least one Server Action burn CPU until the process stops answering anything else. Apps on Pages Router, or with no Server Actions at all, are not vulnerable.
The detail that matters in the version matrix
The patched versions are exactly 15.5.28 and 16.4.1. Nothing else got a release. The advisory ranges run from 10.x (the image optimisation one) and 13.x (the denial of service) all the way up to 15.5.27, so a site parked on 14.x or 15.2 or 15.3 is in scope and has no patch on its own line. Taking 15.5.28 is the upgrade.
What to do
npm install next@16.4.1 # on the 16 line
npm install next@15.5.28 # on the 15 line or anything older
Then check what your lockfile actually resolved for the image library. Fresh installs pick up a fixed sharp on their own, but an existing lockfile will happily keep the old one:
npm ls sharp # or: pnpm why sharp
If you cannot move Next.js yet, the image optimisation advisory can be held off by pinning the fixed library version through your package manager:
{
"overrides": {
"sharp": "^0.35.5"
}
}
That covers one of the three. The use cache remote code execution has no workaround, and neither does the Server Actions denial of service beyond upgrading, so the override is breathing room and not a substitute.