next@16.2.10

• 17 known advisories (worst: critical), fixed in 16.3.8.Evidence
• 26 issues mention 16.2.10 within 14 days of release (usual for this project: 3.5).Evidence

Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work

Malware reports

None known (OSV)

Known advisories

17 known

License

MIT

Install scripts

None

Build provenance

Signed provenance

Weekly downloads

600,343

• criticalGHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
• lowGHSA-39w2-rjm5-chcvNext.js has information disclosure in development server's Model Context Protocol endpoint
• moderateGHSA-4633-3j49-mh5qNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• moderateGHSA-4c39-4ccg-62r3Next.js: Unbounded Server Action payload in Edge runtime
• moderateGHSA-4jqv-mc3x-m676Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
• moderateGHSA-68g3-v927-f742Next.js: Cache confusion of response bodies for requests with bodies
• highGHSA-6gpp-xcg3-4w24Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• highGHSA-89xv-2m56-2m9xNext.js: Server-Side Request Forgery in Server Actions on custom servers
• moderateGHSA-955p-x3mx-jcvpNext.js: Unauthenticated disclosure of internal Server Function endpoints
• highGHSA-cjq9-62q9-8jv4Next.js has Server-Side Request Forgery in Image Optimization

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

26 issues mention this version in vercel/next.js within 14 days of release. See them on GitHub

Check the official release notes below for behaviour changes before merging.

Read the Next.js changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

The maintainer has not deprecated this version on npm.