Sheet 03 · Tags / Next.js
#Next.js
10 posts · 2 projects
AWriting
- Next.js 16.4.5 and 15.5.29: seven fixes, four of them in Cache Components cachingVercel shipped the November 2026 Next.js security release on November 3 in v16.4.5 and v15.5.29. It fixes one high and six medium issues, including cross-tenant cache disclosure when unstable_cache wraps a use cache function and HttpOnly cookies leaking through x-middleware-set-cookie on Edge routes.
- Next.js 16.4.1 and 15.5.28: two critical RCEs in use cache and SVG image optimization, plus a Server Actions DoSVercel published three Next.js advisories on October 14, 2026. A use cache function that returns typed arrays and the Image Optimization API on glibc Linux both allow unauthenticated remote code execution, rated CVSS 9.5. A Server Actions bug can pin the CPU. Upgrade to 16.4.1 or 15.5.28.
- The next/og advisory, and another Next.js patch on September 30A critical advisory on September 22, 2026 covers Next.js 16.2.0 to 16.3.5 through the Node.js ImageResponse in next/og, and a scheduled release on September 30 will fix nine more issues. Triage steps for sites that render OG images.
- Next.js adapters make the platform contract publicOn March 25, 2026, the Next.js team explained the stable Adapter API from 16.2: two build hooks, a public test suite that Vercel's own adapter must pass, verified adapters under the Next.js GitHub org, and a working group with OpenNext, Netlify, Cloudflare, AWS Amplify and Google Cloud.
- Next.js 16.2 for teams that ship on itNext.js 16.2 shipped on March 18, 2026 with faster dev startup, 25% to 60% faster HTML rendering from a React change, Server Fast Refresh, SRI in Turbopack, AGENTS.md in create-next-app and a dev server lock file. Notes from the three release posts.
- Building Next.js for agents starts with debugging for peopleOn February 12, 2026, Jiachi Liu described how the Next.js team built and shut down an in-browser agent called Vector, then moved the useful parts into the framework: an MCP endpoint in next dev, browser logs in the terminal and version-matched docs.
- Inside Turbopack: speed from doing lessOn January 20, 2026, the Turbopack team explained its incremental engine: value cells that track reads like signals, dirty marking that stops when output stays equal, demand-driven recompute and an aggregation graph over millions of results. Your import graph decides how much of that it can skip.
- Next.js 16.1: a disk cache for next dev, a bundle analyzer and next dev --inspectNext.js 16.1 shipped on December 18, 2025. Turbopack's file system cache for next dev is stable and on by default, cutting a large Vercel app's first route compile from 15 s to 1.1 s. It also adds an experimental bundle analyzer, next dev --inspect and transitive serverExternalPackages.
- React Server Components advisories: build a patch laneCVE-2025-55182 let an unauthenticated request run code on any server that supports React Server Components, with a CVSS of 10.0. Researchers probing the fix found three denial-of-service bugs and a source leak over the next eight weeks. This post covers the timeline and a response plan that holds up when the next patch is also incomplete.
- From JAMstack to the App RouterA static site can carry search, feeds and interaction without turning into a backend project. The hard part is the contracts between those systems.