Last 7 days
1
Features: 0
Changes: 0
Fixes: 1
Deprecations: 0
Next.js
React framework for full-stack web applications.
Latest Next.js changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Next.js release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Next.js updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Next.js updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
1
6
14
64
Latest Next.js changelog updates
Backported bug fixes: scoped app entry export validation and corrected catch‑all index page routing.
Turbopack receives numerous enhancements, including async runtime preservation, embedded FS asset conditions, nested promise collapsing, hoisted module registration ordering, and HMR fixes for dynamic imports; cache handling is improved ...
Added traversal guard support from ReplyServer to FlightClient, enhancing security and stability of server-side rendering.
Updated vendored lodash to 4.17.23 fixing CVE‑2025‑13465 and upgraded core dependencies such as tokio and React;
Backported docs fixes for the July 16.2 release
Reject TypeScript 7.0 and surface an actionable error
Fix high‑severity vulnerabilities including DoS in App Router via Server Actions middleware, proxy bypass in Turbopack, and SSRF in rewrites and Server Actions on custom servers
Fix high‑severity Denial of Service in App Router via Server Actions Middleware and Turbopack proxy bypass
Published the @next/swc wasm web package that was unintentionally omitted since v15.5.15.
Publish @next/swc wasm web artifact that was missed since v16.2.4
Release with no code changes to ensure next@latest points to a stable version
No code changes in this release.
Backported bug fixes to 15.5.19, excluding new canary features
Backported numerous bug fixes across core, Playwright integration, dev-mode hydration, router query handling, cache tag encoding, server action rewrites, Turbopack hash encoding, FormData handling, module type handling, and adapter regio...
Production build fixes target route generation and CSS ordering.
Patched high‑severity vulnerabilities including DoS via server components, middleware/proxy bypasses, SSRF in WebSocket upgrades, and cache poisoning in React Server Component responses.
Address multiple high, moderate, and low severity security advisories (DoS, SSRF, XSS, cache poisoning, and middleware proxy bypass)
Patched multiple high‑severity security vulnerabilities (DoS, SSRF, proxy bypass, cache poisoning, XSS) across Server Components, Middleware, and Image Optimization.
Patched high‑severity vulnerabilities such as denial‑of‑service, proxy bypass, SSRF, and cache exhaustion across server components, middleware, and caching layers.
Docs explain stricter remote image matching with clearer examples.
Bump reqwest to 0.13.2, fixing Google Fonts handling on Windows ARM64
Fixed the vulnerability identified as CVE‑2026‑23869
Backported security fixes addressing CVE‑2026‑23869.
Backported bug fixes and stability improvements, including CSS HMR on Safari and glibc Linux CI fixes.
Backported bug fixes for core and Turbopack, including adapter output handling, server actions in standalone mode, and layout segment optimization.
Add LRU disk cache and images.maximumDiskCacheSize option to next/image (feature).
Added many experimental and performance features such as strict route type checking, new routing package, CPU profiling flag, custom cache handlers, LRU cache with invocation IDs, gesturePush, and Claude Code plugin marketplace; expanded...
Backported bug fixes from the canary branch.
Fixed multiple security vulnerabilities (CVE‑2026‑27977‑27980, CVE‑2026‑29057) and prevented request smuggling and unsafe websocket connections.
Backports bug fixes from canary without including all pending features
Fixed memory leak in span map and ensured LRU cache items have a minimum size to prevent unbounded growth.
Backported bug fixes from the canary release.
Security update addressing CVE-2025-59471, CVE-2025-59472, and CVE-2026-23864.
Addresses a critical security vulnerability.
Fix security vulnerabilities identified in CVE-2025-59471 and CVE-2025-59472
Imported from changelog source; review and generate a concise summary before publishing.
Imported from changelog source; review and generate a concise summary before publishing.
Applied security patch addressing identified vulnerabilities.
Security patch released to address a vulnerability.
Addresses security vulnerabilities in the application.
Backports bug fixes without including pending canary features
Backported key bug fixes to the stable release.
Update Turbopack's SWC core to v50.2.3, fixing crashes with MDX files containing multibyte characters
Backported bug fixes from the canary channel to v16.1.1.
Added a built‑in bundle analyzer (next analyze) and multiple Turbopack experimental features, improving build insights and source‑map handling.
Applied a security patch to address vulnerabilities.
Applied security update to address vulnerabilities in Next.js.
Applied security patch for Next.js vulnerabilities
Applied Next.js security update to patch known vulnerabilities
Security patch released for Next.js vulnerabilities.
Applies Next.js security update to patch vulnerabilities.
Applied security patch for Next.js
Applies a security patch for Next.js to address known vulnerabilities
Backported bug fixes from the canary release
Fix for CVE-2025-66478 vulnerability.
Addressed security vulnerability CVE-2025-66478
Addresses security vulnerability CVE-2025-66478.
Fixes security vulnerability CVE‑2025‑66478
Imported from changelog source; review and generate a concise summary before publishing.
Fixes vulnerability identified in CVE‑2025‑66478.
Fixed security vulnerability referenced as CVE-2025-66478.
Backported bug fixes from canary; not all pending features are included.
Backports bug fixes without adding pending features from canary.
Rename proxy.js to middleware.js in the NFT module.