next@16.3.0

• 9 known advisories (worst: critical), fixed in 16.3.8.Evidence
• 115 issues mention 16.3.0 within 14 days of release (usual for this project: 4).Evidence

Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work

Malware reports

None known (OSV)

Known advisories

9 known

License

MIT

Install scripts

None

Build provenance

Signed provenance

Weekly downloads

846,457

• criticalGHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
• lowGHSA-39w2-rjm5-chcvNext.js has information disclosure in development server's Model Context Protocol endpoint
• moderateGHSA-3w37-wq28-93x7Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
• moderateGHSA-4jqv-mc3x-m676Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
• highGHSA-cjq9-62q9-8jv4Next.js has Server-Side Request Forgery in Image Optimization
• moderateGHSA-f87g-xv8r-7p7xNext.js has information disclosure in App Router metadata image routes via dynamicParams bypass
• moderateGHSA-mcj8-r9mp-w47pNext.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
• criticalGHSA-p293-qw3h-jr36Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
• criticalGHSA-vcvr-r3jv-pc5jNext.js: Remote Code Execution in next/og ImageResponse

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

115 issues mention this version in vercel/next.js within 14 days of release. See them on GitHub

Check the official release notes below for behaviour changes before merging.

Read the Next.js changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

The maintainer has not deprecated this version on npm.