Skip to content

Catalog Stack Sift Security Status About Feed

Catalog / Next.js

16.3.6

22 Sep 20261 month agosecurityOriginal notes

This release closes 1 security advisory

criticalRemote Code Execution in next/og ImageResponseCVE-2026-94545

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

What happened next

Next.js 16.3.6 was superseded 7 days later by 16.3.7. 2 releases have followed it on the 16.3.x line, which now stands at 16.3.8.

1 of those 2, on the 16.3.x line:

16.3.8Closes 1 advisory30 Sep 2026

Previous: 16.3.5 Next: 16.3.7

Traceary. Change, on the record.61 products, 5,179 releases

Catalog Changelog Status How the data is collected RSS

Release notes belong to their authors and are shown here under the terms each project publishes them with. Every entry links back to the original, and a publisher can have theirs taken down.

Terms of use Privacy Copyright and removal Imprint