October 2026 security patches: Next.js 16.4.1 and PgBouncer 1.26.1

1. Next.js: the October 14 out-of-band update#

On October 14, 2026 Next.js published an out-of-band security update with two fixes postponed from the September release because of upstream dependency delays. The fixed versions are 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). To install them: npm install [email protected] or npm install [email protected].

For the remote code execution in use cache, Next.js says there is no workaround and that you must upgrade even if your application has no similar functions. For the SVG image one, the workaround is to use sharp 0.35.5 or later; upgrading Next.js makes the package manager install a fixed version.

Documentation: Next.js: October 14, 2026 security update ↗

2. Next.js: the September release#

On September 30, 2026 Next.js had already published fixes in versions 16.3.8 and 15.5.27. The findings are mostly medium severity and depend on specific configurations. The table says who each one affects.

Anyone on 16.3.8 has the September fixes but not the October ones, which were published only in 16.4.1 and 15.5.28.

Documentation: Next.js: September 2026 security release ↗

3. PgBouncer 1.26.1#

PgBouncer 1.26.1 was released on October 14, 2026 and fixes three vulnerabilities. The most serious is an authentication bypass: a client that knows the password of a user in the authentication file can log in as another SCRAM user, including administrators. The changelog gives no severity score.

If you use PgBouncer with SCRAM for several users, prioritize this update. Version 1.26.1 is the latest according to the changelog.

Documentation: PgBouncer: changelog ↗ · PostgreSQL: news archive ↗

4. Check your versions#

The script compares a Next.js version with the fixed versions in the advisories and a PgBouncer version with the affected ranges its changelog publishes. A Next.js line with no fixed version in the advisories (for example 16.2) is treated as «update to 16.4.1», because the advisories list no fixed version for it.

import re

L = {"ok": "up to date", "next": "update to %s", "newer": "newer than the patched lines: check the advisories"}

def parse(version):
    return tuple(int(n) for n in re.findall(r"\d+", version)[:3])

def next_action(version):
    major, minor, patch = parse(version)
    if (major, minor) > (16, 4):
        return L["newer"]
    if (major, minor) == (16, 4):
        return L["ok"] if patch >= 1 else L["next"] % "16.4.1"
    if (major, minor) == (15, 5):
        return L["ok"] if patch >= 28 else L["next"] % "15.5.28"
    return L["next"] % "16.4.1"          # lines with no fixed version in the advisories

PGBOUNCER = {                            # CVE: (first affected version, last affected)
    "CVE-2026-107350": ((1, 17, 0), (1, 26, 0)),
    "CVE-2026-107349": ((1, 20, 0), (1, 26, 0)),
    "CVE-2026-107348": ((1, 21, 0), (1, 26, 0)),
}

def pgbouncer_cves(version):
    v = parse(version)
    return [cve for cve, (first, last) in PGBOUNCER.items() if first <= v <= last]

for v in ["16.2.12", "16.3.8", "16.4.0", "16.4.1", "15.5.27", "15.5.28"]:
    print("next", v, "->", next_action(v))
for v in ["1.19.1", "1.22.0", "1.26.0", "1.26.1"]:
    print("pgbouncer", v, "->", pgbouncer_cves(v))

5. What to do today#

• Check the Next.js version in each project with npm ls next and upgrade to 16.4.1 or 15.5.28.
• If you cannot upgrade immediately and use next/image with SVG, pin sharp at 0.35.5 or later.
• Check whether you use use cache (Cache Components) or Server Actions: they are the surfaces of the most serious findings.
• Upgrade PgBouncer to 1.26.1, especially if it authenticates several users with SCRAM.
• Rebuild and redeploy: updating package.json is not enough until the image or server runs the new version.
• Record in your inventory which projects were patched and the date.

We applied it at Codifly: the site was on 16.2.12 and we moved it to 16.4.1 after tests and the build passed.

Go deeperWhy your build works locally but fails on deploy

6. Keep your numbers current#

The versions and identifiers are those of the advisories published through October 19, 2026. New fixes may appear; check the official Next.js and PostgreSQL advisories regularly.

• Subscribe to the Next.js and PgBouncer security advisories.
• Automate an alert when your version falls below the fixed one.
• Test in a staging environment before promoting to production.