- Fix high‑severity Denial of Service in App Router via Server Actions Middleware and Turbopack proxy bypass
- Mitigate SSRF and cache‑confusion vulnerabilities in rewrites, request bodies (including invalid UTF‑8), and Server Actions on custom servers
- Patch DoS in Image Optimization API (SVG), unauthenticated disclosure of internal Server Function endpoints, and unbounded Server Action payloads in Edge runtime
v15.5.21
Official Next.js changelog summary with source attribution, release tags, and community reactions.
Track this Next.js release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
More Next.js changelog updates
Fix high‑severity vulnerabilities including DoS in App Router via Server Actions middleware, proxy bypass in Turbopack, and SSRF in rewrites and Server Actions on custom servers
Published the @next/swc wasm web package that was unintentionally omitted since v15.5.15.
Publish @next/swc wasm web artifact that was missed since v16.2.4