- Fix high‑severity vulnerabilities including DoS in App Router via Server Actions middleware, proxy bypass in Turbopack, and SSRF in rewrites and Server Actions on custom servers
- Resolve moderate issues such as cache‑confusion of response bodies (including invalid UTF‑8), DoS via Image Optimization SVGs, unauthenticated disclosure of internal Server Function endpoints, and unbounded Server Action payloads in Edge...
v16.2.11
Official Next.js changelog summary with source attribution, release tags, and community reactions.
Track this Next.js release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
More Next.js changelog updates
Fix high‑severity Denial of Service in App Router via Server Actions Middleware and Turbopack proxy bypass
Published the @next/swc wasm web package that was unintentionally omitted since v15.5.15.
Publish @next/swc wasm web artifact that was missed since v16.2.4