By · Keel Automation · October 15, 2026

The leftover preview is not a finished security desk

On Wednesday, the Next.js team shipped an out-of-band security update for two critical remote code execution issues and one high-severity denial of service bug, with patched builds in 15.5.28 and 16.4.1. Netlify's same-day note for customers said the practical step is to upgrade and redeploy, and it added a quieter warning that publicly available deploy previews and branch deploys may stay vulnerable until someone deletes them. Closer to home, Waymo opened fully driverless rides to anyone in Tampa, with no invite code, across nearly 50 square miles of the city. The operations lesson is plain: opening access for everyone is not the same thing as finishing the security checklist on every surface that is still live.

The Friday that looked finished

Picture a shop that gets a security advisory on Wednesday afternoon. Someone bumps the framework version, the build goes green, production redeploys, and the team goes home feeling done. Then, a week later, a customer still has a bookmark to an old deploy preview from a feature branch. That URL still answers. It still runs the old package.

That is the gap these stories keep pointing at. A patched production build is progress. A leftover public preview is unfinished work.

Three patches, one leftover risk

Next.js published its October 14 security update after flagging an upcoming out-of-band release the week before. Two of the fixes had been postponed from a September security release because of upstream dependency delays. The patched versions are 16.4.1 for Active LTS and 15.5.28 for Maintenance LTS.

The advisory lists three issues. GHSA-673q-mjm6-r5xr is a critical unauthenticated remote code execution path in App Router apps that use Cache Components when a use cache function returns multiple typed arrays. Next.js says there is no known workaround and that teams should upgrade even if they do not think they have that pattern. GHSA-2464-fhr4-w9xw, also tracked as CVE-2026-96889, is a critical remote code execution risk in the image library path used for SVG processing on glibc-based Linux, with a workaround of running sharp at 0.35.5 or later. GHSA-p3m5-59mp-jv5r is a high-severity denial of service issue for App Router apps that define at least one Server Action, where crafted requests can burn CPU and block other work in the same process. Pages Router apps, and App Router apps without Server Actions, sit outside that last path.

Netlify's changelog, also dated October 14, translates the same release for its customers. It recommends upgrading next to 15.5.28 or 16.4.1 and redeploying. It also explains how impact differs on its platform: the Cache Components path still matters for matching 16.x apps, the SVG image path through Netlify Image CDN is not exercised the same way as a self-hosted Image Optimization API, and next/og ImageResponse work that renders untrusted input can still crash a function invocation. The Server Actions denial of service has limited blast radius on autoscaling serverless, though active abuse can still raise function cost. The line that belongs on every ops checklist is the one about leftovers: any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted.

A warm editorial cartoon of a shop manager celebrating a PATCHED production board while a small teal robot holds a DELETE stamp beside leftover deploy preview cards still marked OPEN, Florida light in the window, clean vector, bold black outlines, soft cell shading, white minimal background.

That is the operations story. Patching the primary deploy is necessary. It is not sufficient if older public URLs still run the vulnerable package.

Tampa opens the gate the careful way

While the national tooling story was about closing leftover attack surface, Tampa got a local story about opening access only after the staged rollout finished.

On October 14, Waymo said anyone can download the app and ride in Tampa, San Diego, and San Antonio with no invite code required. Waymo Help's announcement is dated the same day. WFLA reported that Tampa residents who needed an activation code in September can now hail a fully autonomous trip, and that the Tampa service area covers nearly 50 square miles from Hyde Park to Northwest Park and Temple Crest, and from Westshore to Highlands Pines. Self Drive News, writing on October 15, adds that the same opening includes San Antonio International Airport for all riders, and that Waymo says it has welcomed hundreds of thousands of riders across those three cities since opening earlier in the year.

That local lane is not a claim that Waymo runs on Next.js or that a ride-hail map is a hosting security control. It is a regional signal about how public access is supposed to work. Tampa did not stay on invite codes forever, and it also did not skip the staged welcome that began September 1. When a company removes the invite gate, it is saying the service is ready for everyone inside the mapped area. When a hosting platform leaves old preview URLs online after a critical patch, it is saying the opposite: the gate is still open on surfaces nobody meant to keep.

What shops should check this week

Most companies will not write a framework security advisory this month. Plenty will still have a public site, a marketing preview, a branch deploy, or a customer demo URL that was never meant to live forever.

Do not confuse "production is patched" with "every live URL is patched." If Netlify, or any host, can keep old previews around until automatic cleanup, ask who deletes them after a critical upgrade. If Server Actions or image rendering paths are in play, ask which apps actually use them before you assume you are outside the advisory. If a local product opens to everyone after a staged invite period, notice the habit: public access arrives after the checklist, not instead of it, before you open the next gate.

A warm editorial cartoon of two colleagues on a Tampa sidewalk, one holding an OPEN TO ALL pass and the other a laptop checklist with patch and preview cleanup checked, while a small teal robot rolls a SECURITY DESK cart, palms nearby, clean vector, bold black outlines, soft cell shading, white minimal background.

A short checklist for this month

You can start without a new platform. Grab the people who own deploys, previews, and the public site.

  1. Inventory every public URL that still serves the app. Include production, deploy previews, branch deploys, and any demo links customers still use.
  2. Upgrade and redeploy the live ones. Move Next.js apps to 15.5.28 or 16.4.1, or the patched line your host documents, and confirm the new build is what each URL serves.
  3. Delete leftover previews on purpose. Do not wait for automatic cleanup if a critical advisory says old public deploys may stay vulnerable.
  4. Name who owns irreversible publish steps. A green production build is not the same thing as a named owner for preview cleanup.
  5. Treat open access as a finished checklist. Whether the product is a ride app or a public site, opening the gate for everyone should follow the security work, not replace it.

Where Keel fits

I write for Keel Automation, a Tampa Bay automation agency founded by Cole Junck. Keel has no partnership or relationship with Next.js, Vercel, Netlify, React, Waymo, WFLA, Self Drive News, or Google's Waymo Help, and nothing in this article is an endorsement from any of them.

The work we do sits next to the leftover-preview problem these stories describe. We build user friendly portals that give a business a one-stop-shop for its processes, integrations that connect the phone system, CRM, website, and accounting tools a team already uses, and SI (Super Intelligence) agents and workflows that pull the right context to a named owner and keep a record of who approved what. The goal is simple: patched production, cleaned previews, and desks that still know which public surface is supposed to stay live.

A purple badge slides toward a preview card, its red status light turns green, and a purple check stamp lands, loop

If your team patched the main site but nobody owns the leftover preview list, you can reach us at (813) 902-4763.

Sources

  1. Next.js, "Next.js Security Update for Upstream Vulnerabilities," October 14, 2026. https://nextjs.org/blog/nextjs-security-update-october-14-2026
  2. Netlify Changelog, "Next.js & React security release (Oct 2026): what to know," October 14, 2026. https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/
  3. GitHub Advisory GHSA-673q-mjm6-r5xr, "Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays," October 14, 2026. https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
  4. GitHub Advisory GHSA-2464-fhr4-w9xw, "Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used," October 14, 2026. https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
  5. GitHub Advisory GHSA-p3m5-59mp-jv5r, "Denial of Service in App Router using Server Actions," October 14, 2026. https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r
  6. Waymo Help, "Waymo is now available to everyone in Tampa, San Diego, and San Antonio!" October 14, 2026. https://support.google.com/waymo/announcements/12766613
  7. Katlyn Fernandez, "Waymo opens driverless rides to anyone in Tampa," WFLA, October 14, 2026. https://www.wfla.com/news/hillsborough-county/waymo-opens-driverless-rides-to-anyone-in-tampa/
  8. Self Drive News Staff, "Waymo Opens to All Riders in San Antonio, San Diego, Tampa," Self Drive News, October 15, 2026. https://selfdrivenews.com/waymo-open-to-everyone-san-antonio-san-diego-tampa/

Read something that sounds like your shop?

Fifteen minutes with Cole. We will tell you what we would fix first and what it costs.

Call (813) 902-4763

Related: more articles · operations portals · business phone + SI

CallText