Skip to content

Loading package…

semverse.

A little more context for your next update.

Built around the sources.

next: 15.5.15 → 15.5.16 · Semverse

nextnpm package

Package

Release notes Compare versions Version history

Package linksRepository View on npm

Latest tag16.3.6

PackagesnpmCompare versions

next

The React Framework

Latest 16.3.63,960 published versionsvercel/next.js

Loading comparison…

Choose your update

Your version

Target version

Include prereleases

1 release to review

6 May 2026 · Newest first

0
Major: 0
Minor: 1
Patch

Release notes available: 1
Commit history only: 0
History missing: 0

Last checked 26 Sept 2026, 23:42 UTC

Checking sources…

On this page1

Showing 1 of 1 releases. Full release notes.

15.5.16

6 May 2026GitHub Release

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Signals highlight changes worth reviewing. They cannot determine whether your application is affected.

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned