Your AI agent set up a Next.js app? The October 2026 Node.js and Next.js security releases

Why this matters if an agent built your app

A coding agent picks a Next.js version on the day it scaffolds the project, and then nobody looks at it again. The lockfile keeps that version until someone changes it. So an app generated in the summer can still run a Next.js release from before 14 October 2026 without anyone having decided that.

This note covers three things: what was fixed, how to check what you run, and what our own data shows about the stacks models name for a new app. It is not a vulnerability analysis and contains no exploit details. Everything about the vulnerabilities comes from the Next.js advisories and the Node.js release notes linked at the end.

What did Next.js fix on 14 October 2026?

Two critical advisories are relevant. Both are rated 9.5 on the CVSS scale. Only one of them has a CVE number.

• GHSA-673q-mjm6-r5xr (published 14 October 2026, CVSS v4 9.5) has no workaround; the fix is Next.js 16.4.1. Next.js 15.x is not affected.
• GHSA-2464-fhr4-w9xw (CVE-2026-96889) has a documented workaround: sharp version 0.35.5 or newer. The real fix is still to update Next.js.

Whether your hosting platform patched anything on its side is not something we checked. Your platform's status page or changelog is the place to look. Updating your own Next.js version does not depend on it.

What did Node.js fix on 21 October 2026?

The Node.js project released security updates on Wednesday, 21 October 2026. They fix 10 CVEs: 4 rated high, 3 medium, 3 low. The fixed versions are 22.23.4, 24.22.1 and 26.12.1, one per release line. The releases also update bundled dependencies (c-ares, OpenSSL, SQLite, undici and the CA certificates).

Which of these affect your app depends on what your code does with them (outbound TLS connections, Brotli, DNS lookups). You do not need to work that out to act: updating to the fixed version of your line covers all ten.

How do I check which Next.js version my app uses?

• In the project folder, run npx next --version. It prints the installed version.
• Or run npm ls next (pnpm why next, yarn why next). This also shows if two copies are installed.
• Open package.json and look at dependencies. A value like ^16.2.0 is a range, not the installed version. The installed version is in the lockfile (package-lock.json, pnpm-lock.yaml or yarn.lock), under the entry for next.
• Compare with the table: 16.0.0 to 16.4.0 is affected by both advisories. 15.5.27 or older (down to 10.0.0) is affected by the image optimization one.
• The version on your live site can differ from the one on your laptop. Check the version that your host actually builds, in the deploy log or the build settings.

How do I check which Node.js version my app uses?

• Locally: node -v.
• In the repository: look for an engines.node entry in package.json, and for a .nvmrc, .node-version or .tool-versions file. These say which version the project asks for.
• On the host: most platforms have a Node.js version setting under project, build or runtime settings. A container build uses the version in the first line of the Dockerfile (for example FROM node:24).
• Compare with the fixed versions: 22.23.4, 24.22.1 or 26.12.1. A version older than these on the same line needs the update. If you run a Node.js line other than 22, 24 or 26, check the Node.js release page to see which line you are on and what it supports. The advisory lists fixes only for those three lines.

How do I update safely?

• Work in a branch and make sure the app builds and its tests pass before you start, so you know what "working" means.
• Next.js 16: npm install next@16.4.1. If you are on 15.x and want to stay there: npm install next@15.5.28, which fixes the image optimization issue.
• Keep react and react-dom at the versions the Next.js release notes ask for; do not update them by guess.
• Node.js: change the version in .nvmrc or engines.node and in your host's runtime setting to the fixed version of your line. Install it locally with your version manager and run node -v.
• Run npm install, then the build, the tests, and click through login, a page with images and any page that uses caching or Server Actions.
• Deploy a preview first if your host offers one. Merge when the preview behaves like before.
• Commit the lockfile. The update is only real once the lockfile changed.

A prompt you can give your coding agent

Check and update the Next.js and Node.js versions of this project. Work on a new git branch.

1. Report the installed Next.js version (run `npx next --version` and read the lockfile), the Node.js version in use (`node -v`, `.nvmrc`, `.node-version`, `engines.node`, Dockerfile), and the Node.js version my hosting settings use if you can see them. Do not guess: say "unknown" where you cannot tell.
2. Compare with these fixed versions: Next.js 16.4.1 (16.x) or 15.5.28 (15.x); Node.js 22.23.4, 24.22.1 or 26.12.1, depending on the line we use.
3. If we are behind, update only next, and react/react-dom only if the Next.js release notes require it. Do not upgrade anything else and do not change the major version of Next.js without asking me first.
4. Update the Node.js version in the project files to the fixed version of the same line.
5. Run install, build and the tests. Show me the output. If something fails, stop and explain; do not edit unrelated code to make it pass.
6. Show me the diff, including the lockfile change. Do not merge, deploy or push. Tell me which settings I must change by hand in my hosting dashboard.

What does the Agent Stack Picks data show?

Agent Stack Picks asks AI models, without a repository or tools, to set up one part of a new app, and counts the tool each model names first. Issue 2026-10 has 900 parsed picks from 9 models in 24 categories. Model pick, not a product recommendation: the data says nothing about quality, security or market share. See the methodology.

The index has no framework category, so we cannot say how often models name Next.js or Node.js as a framework. The two things it does show are hosting and the context in which a model was asked.

• Vercel was named in 36 of 63 hosting picks (57 percent, 95 percent interval 45 to 69 percent) and by all 8 models that answered the hosting prompts. See hosting and Vercel.
• Two of the four contexts name Next.js in the prompt, so a high Vercel share there is partly built into the question. The cleaner signal is the vibe context, where the person says they are not a programmer and the model chooses the technology: 11 of 16 hosting picks again named Vercel. We do not read more into 16 picks.
• Beyond hosting, 39 more picks name a Vercel product or a Next.js feature in other categories (for example the Vercel AI SDK in 13 picks and Vercel Cron in 11). Across all categories, 75 of 900 picks (8 percent) name a tool from this group.
• Two free open models gave 39 of the 63 hosting picks. A first issue with small samples can shift a lot next month.

What this means for you: when you ask an AI model to set up an app and name no technology, the answer often ends up on a Next.js and Vercel-style stack. This is a statement about what models name, not about what coding agents do inside a real repository, and not about the safety of any platform. The stack your agent chose matters for one practical reason: Next.js apps need the version checks above.

What do we see in our own logs?

We run four new sites on one server, this one included. All four run Next.js. The window is 19 October 2026 16:07 UTC to 22 October 2026 16:30 UTC, 65,847 requests in the Caddy access logs. IP addresses are counted, never stored. We log the path and query string, not request bodies.

63 requests (0.10 percent) asked for paths that belong to Next.js internals. The top entries:

• These are probes for Next.js internals on sites that do run Next.js. We cannot tell the intent of the sender, which Next.js version they expected, or whether they relate to the advisories above. The paths are normal parts of Next.js and exist in every version.
• 63 requests is small. Next to them, the same logs hold 8,802 requests for .env files and 5,312 WordPress paths on sites that run neither. Probing of this kind is routine background, not a sign that your own app is being attacked.
• Limits: three days, one server, four small new sites. Other sites will see other numbers.

Checked 22 October 2026

The Next.js facts come from the advisories GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw on github.com/vercel/next.js, read on 22 October 2026. The Node.js facts come from the Node.js vulnerability blog post of 21 October 2026. The Agent Stack Picks numbers come from issue 2026-10, measured on 19 October 2026 (data on the open data page). The log numbers come from the window stated above. If a newer Next.js or Node.js patch release exists when you read this, use the newer one.