diff --git a/.changeset/fix-create-sei-next-sharp-advisories.md b/.changeset/fix-create-sei-next-sharp-advisories.md
new file mode 100644
index 00000000..b1925881
--- /dev/null
+++ b/.changeset/fix-create-sei-next-sharp-advisories.md
@@ -0,0 +1,17 @@
+---
+'@sei-js/create-sei': patch
+---
+
+Bump the Next template's `next` and `sharp` pins to clear three newly published advisories.
+
+The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template:
+
+- `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`.
+- `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`.
+- `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`.
+
+`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors.
+
+Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade.
+
+The remaining `decode-uri-component` finding is moderate and does not block the smoke.
diff --git a/packages/create-sei/templates/next-template/README.md b/packages/create-sei/templates/next-template/README.md
index a3db7c8d..e2d77be9 100644
--- a/packages/create-sei/templates/next-template/README.md
+++ b/packages/create-sei/templates/next-template/README.md
@@ -30,11 +30,13 @@ bun run build
 
 ## Image handling
 
-Next.js image optimization is disabled because Next 15.5.21 declares only vulnerable Sharp 0.34.x releases. The manifest resolves secure Sharp 0.35.x for audit safety, while images are served unoptimized until Next.js supports that Sharp line.
+Next.js image optimization is disabled so the generated app needs no native Sharp build. Turning it on is a template choice rather than a security tradeoff.
+
+The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.4`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), so `0.35.4` is the advisory floor. Loosening or removing the override reintroduces a high audit finding whether or not optimization is enabled.
 
 ## Development bundler
 
-`bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: Next 15.5.21 cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`.
+`bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: the pinned Next 15 line cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`.
 
 ## Sei brand
 
diff --git a/packages/create-sei/templates/next-template/next.config.mjs b/packages/create-sei/templates/next-template/next.config.mjs
index c307b7b1..2bfbbc17 100644
--- a/packages/create-sei/templates/next-template/next.config.mjs
+++ b/packages/create-sei/templates/next-template/next.config.mjs
@@ -5,8 +5,11 @@ const nextConfig = {
 		ignoreDuringBuilds: true,
 	},
 	images: {
-		// Next 15.5.21 declares vulnerable Sharp 0.34.x. Keep the secure 0.35.x
-		// override for resolution, but do not rely on its unsupported optimizer API.
+		// Images stay unoptimized so the generated app needs no native Sharp
+		// build. Keep the manifest's Sharp override: Next declares
+		// `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside
+		// GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that
+		// pin reintroduces a high finding even though this flag is off.
 		unoptimized: true,
 	},
 	webpack: (config) => {
diff --git a/packages/create-sei/templates/next-template/package.json b/packages/create-sei/templates/next-template/package.json
index 0c66fba3..221c62fe 100644
--- a/packages/create-sei/templates/next-template/package.json
+++ b/packages/create-sei/templates/next-template/package.json
@@ -25,7 +25,7 @@
 		"@tailwindcss/postcss": "4.3.3",
 		"@tanstack/react-query": "5.85.3",
 		"ethers": "6.17.0",
-		"next": "15.5.21",
+		"next": "15.5.25",
 		"pino-pretty": "13.1.3",
 		"postcss": "8.5.26",
 		"react": "19.1.2",
@@ -46,7 +46,7 @@
 		"@metamask/sdk": "0.33.1",
 		"@metamask/sdk-communication-layer": "0.33.1",
 		"postcss": "8.5.26",
-		"sharp": "0.35.3",
+		"sharp": "0.35.4",
 		"use-sync-external-store": "1.6.0",
 		"uuid": "11.1.1",
 		"ws": "8.21.3"