next@16.2.12

• 8 known advisories (worst: critical), fixed in 16.3.8.Evidence
• 48 issues mention 16.2.12 within 14 days of release (usual for this project: 4).Evidence

Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work

Malware reports

None known (OSV)

Known advisories

8 known

License

MIT

Install scripts

None

Build provenance

Signed provenance

Weekly downloads

575,719

• criticalGHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
• lowGHSA-39w2-rjm5-chcvNext.js has information disclosure in development server's Model Context Protocol endpoint
• moderateGHSA-4jqv-mc3x-m676Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
• highGHSA-cjq9-62q9-8jv4Next.js has Server-Side Request Forgery in Image Optimization
• moderateGHSA-f87g-xv8r-7p7xNext.js has information disclosure in App Router metadata image routes via dynamicParams bypass
• moderateGHSA-mcj8-r9mp-w47pNext.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
• criticalGHSA-p293-qw3h-jr36Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
• criticalGHSA-vcvr-r3jv-pc5jNext.js: Remote Code Execution in next/og ImageResponse

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

48 issues mention this version in vercel/next.js within 14 days of release. See them on GitHub

Check the official release notes below for behaviour changes before merging.

Read the Next.js changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

The maintainer has not deprecated this version on npm.