Skip to content

Loading package…

semverse.

A little more context for your next update.

Built around the sources.

next: 16.2.10 → 16.2.11 · Semverse

nextnpm package

Package

Release notes Compare versions Version history

Package linksRepository View on npm

Latest tag16.3.6

PackagesnpmCompare versions

next

The React Framework

Latest 16.3.63,958 published versionsvercel/next.js

Loading comparison…

Choose your update

Your version

Target version

Include prereleases

1 release to review

21 Jul 2026 · Newest first

0
Major: 0
Minor: 1
Patch

Release notes available: 1
Commit history only: 0
History missing: 0

Last checked 26 Sept 2026, 23:42 UTC

On this page1

Showing 1 of 1 releases. Full release notes.

16.2.11

21 Jul 2026GitHub Release

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions
Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Signals highlight changes worth reviewing. They cannot determine whether your application is affected.

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies
Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Denial of Service in the Image Optimization API using SVGs
Unauthenticated disclosure of internal Server Function endpoints
Unbounded Server Action payload in Edge runtime