Next.js changelog

This release contains security fixes for the following advisories: Critical: Unauthenticated Remote Code Execution on windows-hosted servers Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [backport] Scope app-entry export validation to files inside the app directory (#97357) [backport] Fix catch-all index p

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in https://github.com/vercel/next.js/pull/96653 [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_co

Core Changes Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558 Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541 Normalize encoded dynamic placeholders in app routes: #91603 Fix(pages-router)

Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031 [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831

This release contains security fixes for the following advisories: High: Denial of Service in App Router using Server Actions Middleware / Proxy bypass in App Router applications using Turbopack and single locale Server-Side Request Forgery

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes Backport documentation fixes for v16.2 (#93804) [backport] Patch playwright-core to resolve _finishedPromise on requestF

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713) Turbopack: fix filesyste

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/ch

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes backport: Move expanded adapters docs to API reference (#92115) (#92129) Backport: TypeScript v6 deprecations for baseUr

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes docs: post release amends (#91715) docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698) Fi

[!TIP]Check out our Next v16.2 Blog Post to learn more about this release. Core Changes Upgrade React from f93b9fd4-20251217 to 65eec428-20251218: #87323 Turbopack: Create junction points instead of symlinks on Windows: #87606 Turbopack: Sy

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194) Apply server actions transform to node_mod