Next.js / update detail

v16.3.8

Official Next.js changelog summary with source attribution, release tags, and community reactions.

Track this Next.js release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Next.js·Sep 30, 2026, 04:13 PMFixSecurity-relevantAI-assisted summary

Summary

Fixed high‑severity SSRF in image optimization and medium‑severity information disclosure in App Router metadata image routes.
Patched multiple cache‑poisoning vulnerabilities affecting SSG/ISR pages, preventing cross‑user content substitution, denial‑of‑service, and leaks from `useCache`/Draft Mode.
Resolved low‑severity information disclosure in the development server’s Model Context Protocol endpoint.

securitybugfixsource healthy

Official source Last checked Oct 5, 2026, 10:02 AM

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked Oct 5, 2026, 10:02 AM

related channels

Turn this Next.js release note into a weekly digest for the tools you actually use.