Next.js metadata image routes can ignore dynamicParams on webpack builds
On September 30, 2026, Next.js published GHSA-f87g-xv8r-7p7x. On a webpack build, opengraph-image and twitter-image routes ignore dynamicParams, so a request can ask for a dynamic segment left out of generateStaticParams. The advisory lists next from 16.0.0. Upgrade that line to 16.3.8. Turbopack builds are not affected.
What was reported
GHSA-f87g-xv8r-7p7x, published September 30, 2026, says that in App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams(). The advisory says applications built with Turbopack are not affected. It lists the affected package as next from 16.0.0. The patched version field on that advisory is not a complete release number.
The September 30, 2026 security release lists this bug, labeled CVE-2026-94485, and names 16.3.8 as the 16.x update for that release. The same post also ships 15.5.27 for the release. This advisory's affected range starts at 16.0.0. This note does not add 15.x to that range.
The CVE record for CVE-2026-94485 uses description text that matches the development-server disclosure, not this metadata-image bug. This note follows the GHSA and the September 30 post, and does not use that record for the impact or the version range.
How to prevent it
Upgrade next to 16.3.8 if you are on 16.0.0 or later, the app is built with webpack, and a metadata image route such as opengraph-image or twitter-image sits on a dynamic segment you excluded from generateStaticParams. The advisory lists the affected range as next from 16.0.0. Its patched field is not a complete release number. The September 30 post names 16.3.8 as the 16.x update. Turbopack builds are not affected.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.