chore(deps): update dependency next to v16.3.8 [security] by renovate[bot] · Pull Request #29 · NOPLAB/rvln

renovate · 2026-07-27T19:16:43Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`16.2.10` → `16.3.8`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-64641 / GHSA-m99w-x7hq-7vfj

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649 / GHSA-89xv-2m56-2m9x

More information

Details

Impact

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.

Workarounds

If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin:

__NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js

#### Severity
- CVSS Score: 8.3 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)
- [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)
- [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Denial of Service in the Image Optimization API using SVGs
[CVE-2026-64644](https://nvd.nist.gov/vuln/detail/CVE-2026-64644) / [GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)

<details>
<summary>More information</summary>

#### Details
##### Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in  `/_next/image` endpoints.

- If you are using `config.images.remotePatterns`, only the patterns in that array are impacted.
- If you are using `config.images.unoptimized: true`, you are NOT impacted.
- If you are using `config.images.loader: 'custom'`, you are NOT impacted.
- If you are using Vercel, you are NOT impacted.

##### Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata : true`.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)
- [https://github.com/vercel/next.js/pull/96006](https://redirect.github.com/vercel/next.js/pull/96006)
- [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://redirect.github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
[CVE-2026-64647](https://nvd.nist.gov/vuln/detail/CVE-2026-64647) / [GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)

<details>
<summary>More information</summary>

#### Details
##### Impact

A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.

This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `삃삃` and `섄섄` in the request body would share the same cache.

##### Workarounds

If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)
- [https://github.com/vercel/next.js/pull/96008](https://redirect.github.com/vercel/next.js/pull/96008)
- [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://redirect.github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Unauthenticated disclosure of internal Server Function endpoints
[CVE-2026-64643](https://nvd.nist.gov/vuln/detail/CVE-2026-64643) / [GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)

<details>
<summary>More information</summary>

#### Details
##### Impact

In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.

Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).

Affected users are applications using App Router + Server Actions.  

By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.
 

##### Workarounds

Never assume any authentication claims at the `use cache` or `use server` boundary. Always authenticate within the boundary.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp)
- [https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3](https://redirect.github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3)
- [https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b](https://redirect.github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Cache confusion of response bodies for requests with bodies
[CVE-2026-64648](https://nvd.nist.gov/vuln/detail/CVE-2026-64648) / [GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)

<details>
<summary>More information</summary>

#### Details
##### Impact

A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.

This only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`.
Safe: `fetch(new Request(init), init)`
Unsafe: `fetch(new Request(init), aDifferentInit)`

##### Workarounds

No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.

#### Severity
- CVSS Score: 6.0 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742)
- [https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c](https://redirect.github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c)
- [https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a](https://redirect.github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-68g3-v927-f742) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)

<details>
<summary>More information</summary>

#### Details
##### Impact

A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

```javascript
// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642 / GHSA-6gpp-xcg3-4w24

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unbounded Server Action payload in Edge runtime

CVE-2026-64646 / GHSA-4c39-4ccg-62r3

More information

Details

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

GHSA-2xp9-vwfh-vxw4

More information

Details

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

CVE-2026-75604 / GHSA-p293-qw3h-jr36

More information

Details

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Severity

CVSS Score: 9.0 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Remote Code Execution in next/og ImageResponse

GHSA-vcvr-r3jv-pc5j

More information

Details

Impact

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js has Server-Side Request Forgery in Image Optimization

CVE-2026-94483 / GHSA-cjq9-62q9-8jv4

More information

Details

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

CVE-2026-94543 / GHSA-4jqv-mc3x-m676

More information

Details

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

CVE-2026-94485 / GHSA-f87g-xv8r-7p7x

More information

Details

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js has information disclosure in development server's Model Context Protocol endpoint

CVE-2026-94486 / GHSA-39w2-rjm5-chcv

More information

Details

The Next.js development server (next dev) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with next dev are affected. Production deployments do not serve this endpoint.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/next.js (next)

`v16.3.8`

Compare Source

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

`v16.3.7`

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @lukesandberg for helping!

`v16.3.6`

Compare Source

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

`v16.3.5`

Compare Source

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
next/image: Reject empty images when reading/writing to the disk cache (#98186)
Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
Add CSP nonce to script tags of loading and template files (#98403)
Fix use cache prerender signal retention (#98448)

`v16.3.4`

Compare Source

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
Fix build error when aliasing typescript to @typescript/typescript6 (#97997)
Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

`v16.3.3`

Compare Source

This release contains security fixes for the following advisories:

Critical:

`v16.3.2`

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)
[backport] Fix catch-all index page being served for every other slug (#97416)
[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

`v16.3.1`

Compare Source

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in #96653
[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in #96655
[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in #96675
[16.x] fix(next/image): preserve image response after optimization by @styfle in #96733
[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in #96900
[backport] Bump @swc/helpers by @mischnic in #96885
[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in #97308
[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in #97302
[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in #97317
[backport] Restore the live headers() view of the incoming request by @unstubbable in #97311
[backport] Allow literal exports in 'use cache' files by @unstubbable in #97312
[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in #97315
[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in #97314
[backport] Encode the cache item name built by unstable_cache by @unstubbable in #97313
[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in #97258
[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in #97328
[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in #97326
[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in #97325
[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in #97304
[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in #97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

`v16.3.0`

Compare Source

Check out the 16.3 announcement post to get an overview of the changes.

Core Changes

Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
Normalize encoded dynamic placeholders in app routes: #91603
Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
Update tokio from 1.43.0 to 1.47.3: #90945
[turbopack] Simplify snapshotting logic: #91178
Turbopack: enable server HMR for app route handlers: #91466
turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
[turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
Skip loadBindings() Lightning CSS check during next start: #91538
turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
Turbopack: Add importModule() support to webpack loaders: #89630
turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
feat(node-streams): add config flag, define-env, and env precedence test: #90427
Rename /_next/webpack-hmr to /_next/hmr: #91415
Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
Handle encoded params further: #91627
[turbopack] Respect {eval:true} in worker_threads constructors: #91666
Fix missing route in otel spans without base-server: #91665
[turbopack] Optimize compaction cpu usage: #91468
Fix layout segment optimization: move app-page imports to server-utility transition: #91701
Fix server actions in standalone mode with cacheComponents: #91711
turbo-persistence: remove Unmergeable mmap advice: #91713
turbopack: move "compact database" tracing span to backend layer: #91693
Turbopack: lazy require metadata and handle TLA: #91705
Fix adapter outputs for dynamic metadata routes: #91680
Turbopack: fix webpack loader runner layer: #91727
[turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
Add module count field to module graph tracing spans: #91697
turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
Turbopack: pull in updated vercel/nft tests: #91651
[turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
[Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
[Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
Avoid deprecated TS node10 moduleResolution defaults: #91847
[turbopack] Rebuild the docker build scripts: #91799
Fix TS6 baseUrl deprecation for extended tsconfig: #91855
Add next internal post-build CLI command for Turbopack database compaction: #91336
Turbopack: Define Effect as a trait instead of a closure: #89080
Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
Use charCodeAt for normalizePathTrailingSlash: #91380
Turbopack: Only patch lockfile when bindings fails to load: #91379
[create-next-app] Skip interactive prompts when CLI flags are provided: #91840
[devtools] Make instant navs panel draggable: #91914
[Segment Bundling] Bundle static prefetches based on size: #91439
turbo-tasks-backend: assert non-transient task_ids in track_modification: #91924
fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #91856
turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #91725
turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #91576
[cna] Upgrade to Biome 2.4 with Tailwind support: #86065
[devtools] Show AggregateError.errors in the error overlay: #91835
Narrow the opengraph-image function return type: #91893
[experiment] Add useOffline flag with offline retry behavior: #92011
adapters: remove unused suffix code: #91997
[experiment] Add useOffline hook to expose offline state to userland: #92012
[turbopack] Don't use turborepo to build the docker image: #92029
Use RcStr directly in napi(object) structs instead of converting to String: #92014
Rename SingleModuleReference::asset to SingleModuleReference::module: #92028
Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #92103
[ftl] Include cause of route types: #92056
fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #73796): #90370
Turbopack: exclude metadata routes from server HMR: #92034
next.config.js: Accept an option for serverFastRefresh: #91968
TURBOPACK: support parse windows absolute path with single slash: #92076
Enable varyParams tracking for Cached Navigations: #92113
telemetry: set turboFlag correctly: #92149
Instant Validation: Allow unconfigured slots to render optionally: #92126
Turbopack: statically evaluate path.sep: #92150
Turbopack: use same hash for immutable-static-hashes.json: #92157
[turbopack] replace regex with indexof: #92023
Turbopack: createRequire(new URL("...", import.meta.url)): #92153
Add PPR evals and fix env loading for agent-eval 0.9.5: #92063
Turbopack: support targeting even older browsers: #91563
Add rust-fingerprint task and SCCACHE passthrough env: #92167
Improve error message for deprecated experimental.dynamicIO config: #92081
[turbopack] Fix CSS HMR on Safari: #92123
simplify session dependent tasks and add TTL support: #91729
disable bmi2 in qfilter: #92177
Improve revalidateTag JS

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 5cbc3ab to 9518089 Compare July 30, 2026 17:14

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 9cb1496 to 388ba19 Compare August 14, 2026 18:45

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 388ba19 to 12605db Compare August 26, 2026 12:47

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 3 times, most recently from 1868dc1 to 5ec82ad Compare September 4, 2026 00:53

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 5247012 to 9e8d4c9 Compare September 11, 2026 03:12

renovate Bot changed the title ~~chore(deps): update dependency next to v16.2.11 [security]~~ chore(deps): update dependency next to v16.3.3 [security] Sep 11, 2026

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 9e8d4c9 to 1773eb9 Compare September 15, 2026 15:33

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 21e3492 to 7ee1d9f Compare September 24, 2026 14:13

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 7ee1d9f to 52368bf Compare October 1, 2026 14:43

renovate Bot changed the title ~~chore(deps): update dependency next to v16.3.3 [security]~~ chore(deps): update dependency next to v16.3.6 [security] Oct 1, 2026

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 52368bf to c4677a1 Compare October 5, 2026 17:51

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 4336a91 to 6c4b2a1 Compare October 16, 2026 00:59

renovate Bot changed the title ~~chore(deps): update dependency next to v16.3.6 [security]~~ chore(deps): update dependency next to v16.3.8 [security] Oct 16, 2026

chore(deps): update dependency next to v16.3.8 [security]

9bc30cf

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 6c4b2a1 to 9bc30cf Compare October 20, 2026 20:07

Navigation Menu

Repository navigation

chore(deps): update dependency next to v16.3.8 [security] - #29

chore(deps): update dependency next to v16.3.8 [security]#29
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-next-vulnerability

renovate Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Next.js: Denial of Service in App Router using Server Actions

Details

Impact

Workarounds

Severity

References

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Details

Impact

Workarounds

Workarounds

Severity

References

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Details

Impact

Workarounds

Severity

References

Next.js: Unbounded Server Action payload in Edge runtime

Details

Impact

Workarounds

Severity

References

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Details

Severity

References

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Details

Impact

Workaround

Severity

References

Next.js: Remote Code Execution in next/og ImageResponse

Details

Impact

Workaround

Severity

References

Next.js has Server-Side Request Forgery in Image Optimization

Details

Impact

Workaround

Severity

References

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Details

Severity

References

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

Details

Severity

References

Next.js has information disclosure in development server's Model Context Protocol endpoint

Details

Severity

References

Release Notes

Core Changes

Credits

Credits

Core Changes

Credits

What's Changed

Core Changes

Configuration

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

renovate Bot commented Jul 27, 2026 •

edited

Loading