Next.js Updates & Release Notes

Follow Next.js to add their release notes to your feed!

80 updates curated from 2 sources by the Releasebot Team. Last updated: Jul 14, 2026

Get this feed:

JavaScript Frameworks

Jul 13, 2026
Date parsed from source:
Jul 13, 2026

First seen by Releasebot:
Jul 14, 2026
Next.js by Vercel

Next.js Security Release and Our Next Patch Release

Next.js formalizes security update releases with regular patches, advance notice, and a first security patch expected July 20, 2026.
Next.js is moving to a formal release process for security updates.

We will publish security patches more regularly, and will give advance notice of these patches.

The first new security relase is expected on July 20, 2026, and will address multiple security issues.

Original source
Jul 1, 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 2, 2026
Next.js by Vercel

v16.2.10

Next.js republishes @next/swc-wasm-web, fixing a package that was missed since 16.2.4.

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.
Original source
All of your release notes in one feed

Join Releasebot and get updates from Vercel and hundreds of other software products.

Create account
Get updates with:
Jul 1, 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 2, 2026
Next.js by Vercel

v15.5.20

Next.js publishes @next/swc-wasm-web, restoring a package missed since 15.5.15.

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.
Original source
Jun 29, 2026
Date parsed from source:
Jun 29, 2026

First seen by Releasebot:
Jun 30, 2026
Next.js by Vercel

Turbopack: What's New in Next.js 16.3

Next.js 16.3 ships Turbopack improvements with memory eviction, persistent build cache, Rust React Compiler support, and import.meta.glob.
Turbopack improvements shipping with Next.js 16.3:

Memory Eviction: Reclaim compiler memory during long development sessions

Persistent Cache for Builds: Reusable cache speeds up successive builds

Rust React Compiler: Faster Rust port of the React Compiler

import.meta.glob: Use Vite-compatible glob imports

Original source
Jun 26, 2026
Date parsed from source:
Jun 26, 2026

First seen by Releasebot:
Jun 27, 2026
Next.js by Vercel

Next.js 16.3: AI Improvements

Next.js 16.3 Preview adds AI improvements for bundled docs, Skills, browser introspection, actionable errors, and Markdown docs.
AI improvements shipping with the Next.js 16.3 Preview

Bundled docs through AGENTS.md: Keep agents reading the version-matched docs

First-party Skills: Help agents drive multi-step workflows

Agent Browser with React introspection: Drive a real browser and inspect React state from agent-browser

Actionable errors: Fix menus and paste-ready prompts for Instant Insights

A smaller, more focused MCP server: Build diagnostics in, knowledge base out

Docs as Markdown: Append .md to any docs URL

Original source
Similar to Next.js with recent updates:
Jun 25, 2026
Date parsed from source:
Jun 25, 2026

First seen by Releasebot:
Jun 26, 2026
Next.js by Vercel

Next.js 16.3: Instant Navigations

Next.js 16.3 Preview adds instant navigations and partial prefetching for faster, SPA-like route transitions.
Available today in the Next.js 16.3 Preview, a new suite of tools that brings the responsiveness of client-driven SPAs to Next.js:

Instant Navigations: Stream or Cache to make a navigation instant, or Block to opt out

Partial Prefetching: A reusable shell per route, cached on the client so a click renders it instantly while the rest streams in

Original source
Jun 9, 2026
Date parsed from source:
Jun 9, 2026

First seen by Releasebot:
Jun 10, 2026
Next.js by Vercel

v16.2.9

Next.js releases an empty stable update to keep next@latest pointing at a stable version.

Empty release to ensure next@latest points at a stable release.

Next.js only allows publishing with Trusted Publishing enabled.

In order to fix NPM dist-tags, we have to release a new version.

Updating dist-tags is not possible with Trusted Publishing.
Original source
Jun 9, 2026
Date parsed from source:
Jun 9, 2026

First seen by Releasebot:
Jun 10, 2026
Next.js by Vercel

v16.2.8

Next.js ships a no-change release to fix next@latest pointing at a prerelease version.

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.
Original source
Jun 1, 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jun 1, 2026
Next.js by Vercel

v16.2.7

Next.js ships a 16.2 backport release focused on bug fixes and stability, with documentation updates, hydration and router fixes, cache tag encoding improvements, server action and middleware fixes, Turbopack changes, and FormData handling improvements.
Note

This release is backporting bug fixes. It does
not
include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

[backport] Fix "type: module" in project dir when using standalone or adapters (#94050)

[backport] Propagate adapter preferred regions (#94200)

[16.2.x] Don't drop FormData entries (#94240)

[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!
Original source
Jun 1, 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jun 1, 2026
Next.js by Vercel

v15.5.19

Next.js backports bug fixes to improve FormData handling and CI stability.
Note

This release is backporting bug fixes. It does
not
include all pending features/changes on canary.

Core Changes

[15.5.x] Don't drop FormData entries (#94244)

Other

[15.5.x] Fix CI (#94281)

Credits

Huge thanks to @eps1lon for helping!
Original source
May 7, 2026
Date parsed from source:
May 7, 2026

First seen by Releasebot:
May 7, 2026

Modified by Releasebot:
May 12, 2026
Next.js by Vercel

v16.2.6

Next.js ships security fixes and backported bug fixes, addressing multiple high, moderate, and low severity advisories along with core fixes for prerender recovery, route params, route handlers, cache keys, and client param parsing.
Note

This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)

Fix fallback route params case in app-page handler (#91737)

Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)

Patch setHeader for direct route handlers (#93101)

Include deployment id in cacheHandlers keys (#93453)

Fix double-encoding of URL pathname parts in client param parsing (#93491)

Original source
May 6, 2026
Date parsed from source:
May 6, 2026

First seen by Releasebot:
May 7, 2026

Modified by Releasebot:
May 13, 2026
Next.js by Vercel

v15.5.18

Next.js ships security fixes across Server Components, App Router, Middleware and Proxy, addressing denial of service, bypass, XSS, SSRF and cache poisoning issues to strengthen overall app safety.
This release contains security fixes for the following advisories:

High

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Original source
May 5, 2026
Date parsed from source:
May 5, 2026

First seen by Releasebot:
May 12, 2026
Next.js by Vercel

v16.2.5

Next.js releases a security-focused patch with backported bug fixes, addressing multiple high, moderate, and low severity advisories across Server Components, App Router, Middleware and Proxy, image optimization, and cache handling while improving route and deployment behavior.
Note

This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)

Fix fallback route params case in app-page handler (#91737)

Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)

Patch setHeader for direct route handlers (#93101)

Include deployment id in cacheHandlers keys (#93453)

Fix double-encoding of URL pathname parts in client param parsing (#93491)

Original source
Apr 16, 2026
Date parsed from source:
Apr 16, 2026

First seen by Releasebot:
Apr 16, 2026
Next.js by Vercel

v16.2.4

Next.js ships a backport release focused on bug fixes and stability, including Turbopack and compiler improvements, Safari cache-buster scoping, Windows ARM64 Google Fonts support, and better tracing and error messages.
Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)

Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)

Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)

Compiler: Support boolean and number primtives in next.config defines (#92731)

turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)

Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)

Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)

Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @Badbird5907, @lukesandberg, @andrewimm, @sokra, and @mischnic for helping!
Original source
Apr 8, 2026
Date parsed from source:
Apr 8, 2026

First seen by Releasebot:
Apr 9, 2026
Next.js by Vercel

v16.2.3

Next.js ships backported security and bug fixes, including stale ISR revalidation error reporting, a manifest.ts HMR fix, output asset deduplication, styled-jsx race condition fixes, and turbo-tasks-backend stability improvements.
Note

This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon, and @ztanner for helping!
Original source

Curated by the Releasebot team

Releasebot is an aggregator of official product update announcements from hundreds of software vendors and thousands of sources.

Our editorial process involves the manual review and audit of release notes procured with the help of automated systems.

About us Our methodology

Next.js Updates & Release Notes

Next.js Security Release and Our Next Patch Release

v16.2.10

v15.5.20

Turbopack: What's New in Next.js 16.3

Turbopack improvements shipping with Next.js 16.3:

Next.js 16.3: AI Improvements

AI improvements shipping with the Next.js 16.3 Preview

Similar to Next.js with recent updates:

Next.js 16.3: Instant Navigations

v16.2.9

v16.2.8

v16.2.7

Note

Core Changes

Credits

v15.5.19

Note

Core Changes

Other

Credits

v16.2.6

Note

Security Fixes

High:

Moderate:

Low:

Core Changes

v15.5.18

High

Moderate

Low

v16.2.5

Note

Security Fixes

High

Moderate

Low

Core Changes

v16.2.4

Note

Core Changes

Credits

v16.2.3

Note

Core Changes

Credits

Curated by the Releasebot team