next.js

Check out the 16.4 announcement post(https://nextjs.org/blog/next-16-4) to get an overview of the changes. Core Changes - Show compiler plugin warning in more situations: 75682 - fix(scripts):

This release contains security fixes for the following advisories: High: - Server-Side Request Forgery in Image Optimization(https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8j

This release contains security fixes for the following advisories: Medium: - Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass(https://github.com/vercel/n

> !NOTE > This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes - turbo-tasks-backend: fix strongly consistent read hanging on a cance

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse(https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

The following bug fixes have been backported. It does not include all pending features/changes on canary. - next/image: Skip 0-byte entries when initializing disk LRU cache (98185) - next/image: R

Follow-up release to v16.3.3(https://github.com/vercel/next.js/releases/tag/v16.3.3) re-enabling AVIF Image Optimization (97949(https://github.com/vercel/next.js/pull/97949)). The following bug fix

Follow-up release to v15.5.24(https://github.com/vercel/next.js/releases/tag/v15.5.24) re-enabling AVIF Image Optimization when newer versions of sharp are installed (97954(https://github.com/vercel/n

This release contains security fixes for the following advisories: Critical: - Unauthenticated Remote Code Execution on windows-hosted servers(https://github.com/vercel/next.js/security/advisori