Next.js releases
Every Next.js release, newest first: stable versions, security patches, backports and canaries, with what changed in each.
November 2026
- 16.4.6Update
Next.js v16.4.6 released with backported bug fixes
Vercel published Next.js v16.4.6 on 2026-11-09. The release backports bug fixes, including pinning Tailwind to 4.3.3 in create-next-app and tests, automatic compression of route handler responses when not already compressed, and Turbopack garbage collection fixes for development.
- 16.5.0-canary.42Update
Next.js v16.5.0-canary.42 released with Request Insights updates and automatic route handler response compression
Vercel published Next.js v16.5.0-canary.42 on its GitHub releases page on 2026-11-05. The canary includes changes to Request Insights, automatic compression of route handler responses, an SWC bump to v84, and the removal of optimizeImage from the public next/image-optimizer-transform API, along with several Turbopack fixes.
- 15.5.29Update
Next.js v15.5.29 released with security fixes for three moderate advisories
Vercel published Next.js v15.5.29 on its GitHub releases page on 2026-11-03. The release includes security fixes for three moderate-severity advisories: cross-client response injection in self-hosted apps forwarding fetched responses, an SVG rejection bypass in image optimization, and HttpOnly cookie exposure via an internal response header on Edge runtime routes.
- 16.4.5Update
Next.js v16.4.5 released with security fixes for seven advisories
Vercel published Next.js release v16.4.5 on GitHub on 2026-11-03. The release contains security fixes for seven advisories, all rated Moderate, covering the 'use cache' directive, Cache Components fallback shells, self-hosted response forwarding, SVG handling in image optimization, and cookie exposure on Edge runtime routes.
October 2026
- 16.4.1Update
Next.js v16.4.1 released with security fixes for three advisories
Vercel released Next.js v16.4.1 on 2026-10-14 containing security fixes for two critical advisories (unauthenticated remote code execution in use cache functions returning typed arrays, and in the Image Optimization API when SVG files are used) and one high-severity advisory (denial of service in App Router using Server Actions).
- 15.5.28Update
Next.js v15.5.28 released with security fixes for a critical RCE and a high-severity DoS
Vercel published Next.js v15.5.28 on its GitHub releases page on 2026-10-14. The release includes security fixes for a critical unauthenticated remote code execution issue in the Image Optimization API when SVG files are used, and a high-severity denial of service issue in the App Router involving Server Actions.
September 2026
- 16.3.8Update
Next.js 16.3.8 and 15.5.27 fix nine vulnerabilities, one critical
Next.js published 16.3.8 and 15.5.27 on September 30, 2026 as a scheduled security release covering nine vulnerabilities: one critical, two high, five medium and one low. The 15.5 line receives the backported fixes. The 16.3.7 release on September 29 was a bug fix only and does not include them.
- Update
Next.js patches a critical remote code execution bug in next/og
Next.js shipped an out-of-band security update on September 22, 2026 in 16.3.6 and 15.5.26. It fixes a critical issue in the Node.js ImageResponse implementation in next/og, where improper escaping in SVG output generated by Satori could lead to remote code execution. Versions from 16.2.0 up to 16.3.5 are affected. The Edge ImageResponse is not affected, and 15.x only receives hardening.
- 16.3Update
Next.js 16.3 adds experimental controls over how Turbopack chunks JavaScript
Vercel published the reasoning behind Turbopack's chunking on September 3, 2026, with new experimental options in Next.js 16.3. generateComponentChunks emits un-merged chunks beside merged ones so the runtime can fetch whichever is cheaper given what the browser holds. firstPageLoadPriority, priorityRoutes and clusters replace Turbopack's assumption that two thirds of sessions are one page. turbopackSharedRuntime also cuts a blocking request and about 10 KB per navigation.