The React framework for production: routing, rendering, and scale.
Timace is not only a directory. Every tool it tracks can be dropped into something you are building. A free account keeps what you make.
Pick the categories your project needs and choose real tools for each one, with Next.js in the mix.
Open the builderGroup Next.js with everything else you actually use, and share the stack as a page.
Browse stacksWrite out the steps of a job you do repeatedly and place Next.js at the step it belongs to.
Browse workflowsKeep Next.js in a named list, and let the Intelligence Feed surface news about it.
Your library2026-10-16
Vercel and Shopify release Vercel Shop, an open source storefront template for agent shoppers
Vercel announced that Vercel Shop, an open source Next.js storefront template built with Shopify, is generally available. The template exposes product pages in machine-readable form, supports the Universal Commerce Protocol via MCP at the merchant's domain, and includes a shopping assistant that shares a cart with the storefront; the rebuilt Hydrogen SDK is also generally available.
2026-10-14
Next.js v16.4.1 released with security fixes for three advisories
Vercel released Next.js v16.4.1 on 2026-10-14 containing security fixes for two critical advisories (unauthenticated remote code execution in use cache functions returning typed arrays, and in the Image Optimization API when SVG files are used) and one high-severity advisory (denial of service in App Router using Server Actions).
2026-10-14
Next.js v15.5.28 released with security fixes for a critical RCE and a high-severity DoS
Vercel published Next.js v15.5.28 on its GitHub releases page on 2026-10-14. The release includes security fixes for a critical unauthenticated remote code execution issue in the Image Optimization API when SVG files are used, and a high-severity denial of service issue in the App Router involving Server Actions.
2026-09-30
Next.js 16.3.8 and 15.5.27 fix nine vulnerabilities, one critical
Next.js published 16.3.8 and 15.5.27 on September 30, 2026 as a scheduled security release covering nine vulnerabilities: one critical, two high, five medium and one low. The 15.5 line receives the backported fixes. The 16.3.7 release on September 29 was a bug fix only and does not include them.
2026-09-22
Next.js patches a critical remote code execution bug in next/og
Next.js shipped an out-of-band security update on September 22, 2026 in 16.3.6 and 15.5.26. It fixes a critical issue in the Node.js ImageResponse implementation in next/og, where improper escaping in SVG output generated by Satori could lead to remote code execution. Versions from 16.2.0 up to 16.3.5 are affected. The Edge ImageResponse is not affected, and 15.x only receives hardening.
2026-09-03
Next.js 16.3 adds experimental controls over how Turbopack chunks JavaScript
Vercel published the reasoning behind Turbopack's chunking on September 3, 2026, with new experimental options in Next.js 16.3. generateComponentChunks emits un-merged chunks beside merged ones so the runtime can fetch whichever is cheaper given what the browser holds. firstPageLoadPriority, priorityRoutes and clusters replace Turbopack's assumption that two thirds of sessions are one page. turbopackSharedRuntime also cuts a blocking request and about 10 KB per navigation.
