Netlify Updates & Release Notes

Netlify Server lets you run your application’s backend as a long-lived Node.js server. Netlify provisions it, scales it with demand and scales it down to zero when nothing is using it.

Whereas, functions handle one request per instance and finish when they respond, some backends need more. Netlify Server keeps running between requests so that it can:

• Handle many requests at once in a single instance.
• Keep warm database connection pools and in-memory caches.
• Hold WebSocket and Server-Sent Events connections open, for things like live chat and real-time collaboration.
• Run an existing Express, Hono, Fastify or Koa app as-is, without additional adapters.

A server is a single file at netlify/server/index.ts. Here’s a simple way to get started without any framework, with the same signature as a Netlify function:

import type { Context } from '@netlify/server';

export default async (req: Request, context: Context) => {
  return Response.json({ message: `Hello from ${context.geo.city}` });
};

Every deploy, including branch deploys and Deploy Previews, runs its own version of your server. The server can use other platform primitives, such as Netlify Database, Netlify Blobs and the AI Gateway, with no setup.

Full-stack frameworks such as Next.js, Astro and Nuxt don’t run on Netlify Server yet, so for now we recommend using a server in projects that don’t use one of these frameworks.

Early Access

Netlify Server is available on credit-based plans and on Enterprise plans with credits enabled. Its APIs and behavior might change during Early Access.

In Agent Runners, we’re releasing Netlify Server gradually over the coming days, so your agent runs might not use it right away.

Limits

These are the main limits during Early Access:

• A server scales up to 3 instances, or 1 instance on credit-based Free and Personal plans.
• An instance always scales to zero after 5 minutes without requests. After Early Access, you’ll be able to keep a minimum number of instances running, so infrequent requests won’t need to wait for your server to start.

The limits page has the full list.

Pricing

Netlify Server is free to use during Early Access. When it reaches General Availability, usage will be charged in credits based on two meters: reserved memory (in GB-hours) and active CPU time (in vCPU-hours). We’ll announce the cost in credits before then. If your usage during Early Access suggests you’ll need to upgrade your plan or buy more credits, we’ll let you know.

Other metered features in your project are billed as usual, and every request your server handles counts toward the web requests meter. Learn more about pricing.

To get started, read the Netlify Server docs and follow the guide to create your first server.

Netlify Visual Editor is deprecated as of November 10, 2026, and will reach end of life on February 8, 2027. After that date, Visual Editor will no longer be available or supported.

Your sites stay live and your content stays right where it is. The only thing that changes is how you make edits.

Timeline

• Date: November 10, 2026
  • What happens: Visual Editor is deprecated. No new teams or projects can enable it.
• Date: February 8, 2027
  • What happens: Visual Editor reaches end of life and is no longer available or supported.

If your team already has Visual Editor enabled, you can keep using it until February 8, 2027, and the Visual Editor docs still apply until then. No new teams or projects can enable Visual Editor.

How to keep editing

The Visual Editor, previously called "Netlify Create", was designed before prompting updates was a common way people worked. Depending on how your team works, here’s how to keep editing:

• Using a CMS? Keep editing there. Nothing changes for you.
• Already using Claude or Codex? Point your agent to netlify.ai to get the skills and tools it needs to work with your project.
• Want to edit with a prompt in Netlify? Open your project and tell Agent Runners what to change. There’s nothing to install, configure, or connect first. You’ll see the result in a side-by-side preview, and nothing goes live until you publish.

Edit with Agent Runners

Agent Runners runs on credits, so you need a credit-based plan or an Enterprise plan that uses credits. If you’re on a legacy plan, compare plans or learn how to change your pricing plan.

A few things you can ask Agent Runners for:

• Edit content: “Update the homepage headline and swap the hero image.”
• Fix a layout: “The pricing cards stack badly on mobile. Fix the spacing.”
• Add a page: “Add an About page with our team and a contact form.”

Share feedback and get help

We’ll keep adding to what Agent Runners can do, and we want to hear what you’d like next. Tell us in the Netlify Discord, where the team and other builders are around to help and swap tips.

Learn more in the Agent Runners docs, or reach out to Netlify Support with any questions.

Google’s Gemini 4 Carbon model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required.

Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 4 Carbon model:

import { GoogleGenAI } from '@google/genai';

export default async () => {
  const ai = new GoogleGenAI({});
  const response = await ai.models.generateContent({
    model: 'gemini-4-carbon',
    contents: 'How can AI improve my coding?'
  });
  return Response.json(response);
};

Gemini 4 Carbon is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.

Learn more in the AI Gateway documentation and Agent Runners documentation.

Following our recent change to form notification email requirements, you can now send notifications to email addresses outside your Netlify team no matter what pricing plan you are on.

You can now send form notifications to email addresses that don’t belong to a member of your Netlify team, such as a client or a shared inbox like [email protected], as long as the recipient confirms they want to receive them.

When you add an email address that isn’t connected to a member of your Netlify team, Netlify first sends that address a short email asking whether it wants to receive notifications for your form. No form notifications are delivered to the address until the recipient clicks Confirm. If they ignore the email, they never receive any notifications about your form submissions.

Notifications sent to team members work the same as before and don’t need confirmation.

If you switched a notification to a team member’s address after our recent change to form notification email requirements, you can now add the original address back. After confirming, you’ll start receiving notifications about form submissions to the confirmed email address.

Learn more about form notifications in our docs.

Meta’s Muse Ember 1.0 model is now available through Netlify’s AI Gateway with zero configuration required. Use muse-ember-1.0 alongside the Muse Spark and Muse Wonder models already available in AI Gateway.

Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway takes care of the setup automatically. Here’s an example using Muse Ember with the Responses API:

import OpenAI from 'openai';

export default async () => {
  const meta = new OpenAI();
  const response = await meta.responses.create({
    model: 'muse-ember-1.0',
    input: 'How can AI improve my coding?'
  });
  return Response.json(response);
};

This Meta model also works in Scheduled Functions, Background Functions, and Edge Functions, with Netlify’s caching, rate limiting, and authentication infrastructure available automatically.

Learn more in the AI Gateway documentation and explore the models on Meta’s developer site.

Anthropic’s Claude Fable 5.2 model is now available through Netlify’s AI Gateway with zero configuration required. Use claude-fable-5-2 alongside the other Claude models already available in AI Gateway.

Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using Claude Fable 5.2 with the Messages API:

import Anthropic from '@anthropic-ai/sdk';

export default async () => {
  const anthropic = new Anthropic();
  const response = await anthropic.messages.create({
    model: 'claude-fable-5-2',
    max_tokens: 4096,
    messages: [
      { role: 'user', content: 'How can AI improve my coding?' }
    ]
  });
  return Response.json(response);
};

Claude Fable 5.2 also works in Scheduled Functions, Background Functions, and Edge Functions, with Netlify’s caching, rate limiting, and authentication infrastructure available automatically.

Learn more in the AI Gateway documentation.

Netlify now publishes a JSON schema for netlify.toml, so you can catch configuration errors in your editor instead of in a failed deploy. The schema describes the supported properties, the values they accept, and what they do, shortening the feedback loop for discovering and fixing mistakes.

To use it, add a $schema key at the top of your netlify.toml:

"$schema" = "https://open-api.netlify.com/netlify.schema.json"
[build]
command = "npm run build"
publish = "dist"

If you write code yourself, editors that support JSON schemas for TOML files can suggest properties as you type, show their descriptions inline, and flag invalid values as you work. In VS Code, install the Even Better TOML extension to turn on schema support for TOML files. You no longer need to keep the docs open in another tab or learn about a typo from your build log.

If an agent writes code for you, the same schema gives it a machine-readable contract for the file. Agents can check the configuration they generate against the schema and fix invalid properties or values before anything is deployed, instead of deploying, reading the failure, and trying again. That means fewer broken deploys for you to review and a faster path from a generated netlify.toml to one that works.

Netlify ignores the $schema key when it builds and deploys your project. Some checks, such as whether a configured directory exists, can only happen during the build, so a file that passes the schema can still fail to build.

Learn more about schema validation for netlify.toml.

OpenAI’s GPT Image 2.6 Sunburst (gpt-image-2.6-sunburst) and GPT Image 2.6 Flare (gpt-image-2.6-flare) models are now available through Netlify’s AI Gateway with zero configuration required.

Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically.

GPT Image 2.6 Sunburst and GPT Image 2.6 Flare are also available across Scheduled Functions, Background Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.

Learn more in the AI Gateway documentation.

Your agent can now tell us when something gets in its way.

All you need is to have the Netlify MCP Server installed or set up. If you're using a Netlify Connector or plugin with your agent, you don't need extra setup here.

Starting today, the Netlify MCP includes a new feedback tool that lets agents submit feedback or report issues to Netlify on their own when they run into a problem they can’t resolve.

The tool works wherever you use Netlify MCP, including our connectors and plugins. When your agent gets stuck, for example on an unclear error or a missing capability, it can report what happened instead of leaving it as a dead end in the conversation.

We combine this feedback to find where agents struggle on Netlify, then use it to improve the Agent Experience (AX). That means the problems your agent hits today are less likely to slow it down next time.

If your agent is already connected to Netlify MCP, it can use the feedback tool now. To get started, connect to the Netlify MCP server.

You can now check on your deploys right where you’re working. Netlify MCP gives you a visual overview of your project’s deploys in ChatGPT and other clients that support MCP Apps, so you don’t need to switch to the Netlify dashboard to see whether your latest deploy went live or why it failed.

Netlify Deploys card in an MCP client showing five recent deploys for a project, each with a ready status, the deploy context and branch, the creation time, and links to visit the deploy or open it in Netlify. A status filter and a Refresh button sit at the top of the card.

Ask “Show recent deploys for my project” to open a card with up to five recent deploys, or ask about a specific deploy. Each deploy shows its status, branch, creation time, and any error message, with links to visit the deployed site or inspect the deploy in Netlify. Status filters help you find successful, unsuccessful, or queued deploys, and team details give you context for the project.

While any of the deploys on the card are still in progress, the card refreshes automatically, so you can watch a deploy finish without asking again. Automatic refresh stops when they finish or after 15 minutes; select Refresh to check again.

Clients without MCP Apps support receive a text summary instead.

To get started, connect to the Netlify MCP server.

If you do not have an Enterprise plan or Legacy Business plan, form notification emails must now belong to a member of your Netlify team.

When you set up a form notification that sends form submission details to an email address, you must use an email address connected to a member of your Netlify team. This requirement also applies when you edit an existing form notification that sends updates to an email address.

If you already have an email address set up for form notifications that isn’t connected to a member of your Netlify team, such as [email protected], your notifications keep working as before. You only need to meet this new requirement the next time you create or edit a form notification that uses an email. You can’t save an edit that uses an email address that isn’t connected to a member of your Netlify team.

We recommend that you either invite the owner of the address to your Netlify team so you can keep using it, or switch the recipient to an existing team member’s address before you next edit the notification.

Update: Email confirmation for recipients outside your team has shipped. Read the details in Email Confirmation for External Form Notification Recipients.

Learn more about form notifications in our docs.

The Next.js team has disclosed seven security vulnerabilities in Next.js, patched on November 3, 2026 in 16.4.5 and 15.5.29. The issues span cached data leaking between users, exposure of HttpOnly cookies, cache poisoning, and cross-client response injection. Several of them do not affect apps hosted on Netlify. Here's what Netlify customers need to know.

Summary

Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in Impact on Netlify), so if you run Next.js on Netlify, we strongly recommend upgrading next to 16.4.5 (or 15.5.29 on 15.x) and redeploying. One issue also needs an update to the OpenNext Netlify Next.js adapter, @netlify/plugin-nextjs 5.16.6. The adapter is auto-installed by default, so a redeploy picks it up. You only need to upgrade it manually if you pin its version. See What should I do? for full steps.

Vulnerabilities

• Vulnerability: GHSA-vc7v-qv4w-wrv8
  — Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata
  CVE: CVE-2026-119351
  Severity: Medium
  Affected: 16.2+ apps using Cache Components with nested use cache functions and root params

• Vulnerability: GHSA-7qx7-33qx-rqx2
  — SVG rejection bypass in Next.js image optimization
  CVE: CVE-2026-119347
  Severity: Medium
  Affected: 15.x/16.x apps using the built-in image optimizer with images.dangerouslyAllowSVG: false

• Vulnerability: GHSA-vvgp-ww4w-46vf
  — Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
  CVE: CVE-2026-119350
  Severity: Medium
  Affected: 16.4+ apps using Cache Components with certain dynamic route shapes

• Vulnerability: GHSA-mfr8-8qww-v76h
  — Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache()
  CVE: CVE-2026-119790
  Severity: Medium
  Affected: 16.3+ apps using Cache Components that call the same use cache function directly and through unstable_cache

• Vulnerability: GHSA-f3mh-rxg3-f5g2
  — HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes
  CVE: CVE-2026-119346
  Severity: Medium
  Affected: Edge Route Handlers and Edge API routes that set HttpOnly cookies

• Vulnerability: GHSA-rhh4-g77r-r9qj
  — Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
  CVE: CVE-2026-119349
  Severity: Medium
  Affected: 16.x apps passing binary arguments (e.g. Blob) to a shared use cache function

• Vulnerability: GHSA-pc58-hwjq-p385
  — Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
  CVE: CVE-2026-119348
  Severity: Medium
  Affected: Self-hosted App Router routes returning a fetched response unchanged, behind certain reverse proxies

Impact on Netlify

Not affected on Netlify

• GHSA-7qx7-33qx-rqx2
  (SVG rejection bypass): Netlify projects are not affected. Image optimization on Netlify is handled by Netlify Image CDN, so the vulnerable Next.js image optimizer code is not used. Netlify Image CDN serves SVG images with a Content Security Policy that prevents scripts from running.

• GHSA-mfr8-8qww-v76h
  (use cache leak via unstable_cache): Netlify projects are not affected. This leak requires two requests to share a single server process's in-progress cache fill. On Netlify's serverless architecture each request is served by its own isolated invocation, so the required overlap cannot occur.

• GHSA-pc58-hwjq-p385
  (cross-client response injection): Netlify projects are not affected. Netlify's infrastructure frames responses itself, so a response with an incorrect length from your app cannot affect responses to other requests. However, on unpatched versions, a Route Handler that returns a fetched response unchanged can send a response that browsers fail to decode. Upgrading Next.js resolves it.

Information disclosure

GHSA-vc7v-qv4w-wrv8 (nested use cache leak) and GHSA-rhh4-g77r-r9qj (binary use cache arguments): under the conditions in each advisory, content cached for one user or root param value (e.g. a locale or tenant) can be served to another. On Netlify, apps that meet those conditions are affected. Upgrading Next.js resolves both.

GHSA-f3mh-rxg3-f5g2 (HttpOnly cookies in Edge responses): exploitation requires an attacker to already be able to run JavaScript on your site's origin. It can then read cookies marked HttpOnly. On Netlify, this affects Edge Route Handlers and Edge API routes, and also cookies set in Next.js Middleware. The Netlify adapter update alone covers all of these. Upgrading Next.js fixes Edge Route Handlers and Edge API routes. The Middleware case is fixed in the Netlify adapter, so you also need adapter 5.16.6. See What should I do?

Cache poisoning and availability

GHSA-vvgp-ww4w-46vf (cache poisoning of shared fallback shells): affects Next.js 16.4+ apps using Cache Components with the route shape described in the advisory. A single request can cause valid pages to return a cached 404 error. On Netlify, apps that meet those conditions are affected. Upgrading Next.js resolves it.

What should I do?

We strongly recommend upgrading as soon as possible:

• Upgrade next to 16.4.5 (or 15.5.29 if you're on 15.x) and redeploy.
• The OpenNext Netlify Next.js adapter that runs your app must also be updated to v5.16.6:
  • Auto-installed adapter (default): redeploy — the update is applied automatically.
  • Manually installed adapter: upgrade @netlify/plugin-nextjs to v5.16.6 and redeploy. Upgrading Next.js alone does not fix the Middleware case on Netlify. We recommend not pinning the adapter version so future fixes ship automatically.

A new deploy clears content cached by previous deploys in the same deploy context, including any entries affected by these issues. A production deploy does not clear the cache for branch deploys or Deploy Previews (and vice-versa). Purge affected entries in those contexts separately, purge the whole site or delete those deploys. If you've opted responses out of automatic invalidation with the Netlify-Cache-ID header, those stay cached after a deploy, so purge them on demand.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.

Resources

• Next.js November 2026 security release
• Next.js security advisories

You can now power your Netlify Agent Runners runs with Meta’s Muse family of AI models. Choose Muse for your next run and pick the model that fits the task, from Meta’s most capable Muse Wonder 1.0 for complex software engineering and long-horizon agentic work to Muse Spark 1.3, tuned for agentic workflows and coding.

To use a Muse model, open the agent configuration for your run and select Muse as your agent. Then choose a specific model: Muse Wonder 1.0, Muse Spark 1.3, or Muse Spark 1.2. Or you can leave it on Auto to let the agent pick a model for each run. Each model shows its estimated credit cost so you can weigh capability against spend before you start.

Agent configuration dialog showing the Muse tab with Muse Wonder 1.0, Muse Spark 1.3, and Muse Spark 1.2 model options

Muse joins Claude, Codex, Antigravity, and OpenCode in the agent configuration, so you’re never locked into a single provider and can match the model to the work at hand. You can start using Muse models today with no additional setup if you have a Credit-based pricing plan on Netlify, including our free plan.

Learn more in the Agent Runners documentation.

You can now connect Netlify to Grok with the Netlify connector, so your Grok agent can answer questions about your projects, update supported project settings, and deploy to Netlify through conversation.

The connector gives Grok up-to-date context for building and deploying to Netlify, and it works across Grok Bot, Grok CLI, and grok.com.

You don’t need to call the connector by name. Describe what you want, and when the task needs Netlify access, Grok uses the connector for you. For example, you can ask Grok to:

• “Deploy this project to Netlify.”
• “What’s the status of my latest deploy?”
• “Show me my Netlify projects.”
• “Build me a website for my restaurant and deploy it to Netlify.”

To get started, open Connectors in Grok, search for Netlify, then select Add and follow the setup prompts. You’ll need a Grok account with access to connectors and a Netlify account.

Learn more in our guide to setting up Grok for Netlify.

MiniMax’s M3.1 Flash model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required.

Use the OpenRouter SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using MiniMax M3.1 Flash:

import { OpenRouter } from '@openrouter/sdk';

export default async () => {
  const client = new OpenRouter();
  const response = await client.chat.send({
    chatRequest: {
      model: 'minimax/minimax-m3.1-flash',
      messages: [{ role: 'user', content: 'How can AI improve my coding?' }],
      maxTokens: 400,
    },
  });
  return Response.json(response);
};

MiniMax M3.1 Flash is also available across Scheduled Functions, Background Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.

Learn more in the AI Gateway documentation and Agent Runners documentation.