Next.js changelog

Check out the 16.4 announcement post to get an overview of the changes. Core Changes Show compiler plugin warning in more situations: #75682 fix(scripts): correct typo in rm.mjs error message: #87015 docs: improve clarity and punctuation in

This release contains security fixes for the following advisories: High: Server-Side Request Forgery in Image Optimization Medium: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Cache poisoning o

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931) Credits Huge thanks to @lukesandbe

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

The following bug fixes have been backported. It does not include all pending features/changes on canary. next/image: Skip 0-byte entries when initializing disk LRU cache (#98185) next/image: Reject empty images when reading/writing to the

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949). The following bug fixes have been backported. It does not include all pending features/changes on canary. testmode: Fix infinite recursion in testmode passthrough fe

This release contains security fixes for the following advisories: Critical: Unauthenticated Remote Code Execution on windows-hosted servers Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [backport] Scope app-entry export validation to files inside the app directory (#97357) [backport] Fix catch-all index p

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in https://github.com/vercel/next.js/pull/96653 [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_co

Check out the 16.3 announcement post to get an overview of the changes. Core Changes Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558 Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541 Normal

Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031 [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831

This release contains security fixes for the following advisories: High: Denial of Service in App Router using Server Actions Middleware / Proxy bypass in App Router applications using Turbopack and single locale Server-Side Request Forgery

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes Backport documentation fixes for v16.2 (#93804) [backport] Patch playwright-core to resolve _finishedPromise on requestF

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713) Turbopack: fix filesyste

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/ch

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes backport: Move expanded adapters docs to API reference (#92115) (#92129) Backport: TypeScript v6 deprecations for baseUr

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes docs: post release amends (#91715) docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698) Fi

[!TIP]Check out our Next v16.2 Blog Post to learn more about this release. Core Changes Upgrade React from f93b9fd4-20251217 to 65eec428-20251218: #87323 Turbopack: Create junction points instead of symlinks on Windows: #87606 Turbopack: Sy

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194) Apply server actions transform to node_mod