Skip to content

Loading package…

semverse.

A little more context for your next update.

Built around the sources.

next: 16.2.5 → 16.2.6 · Semverse

nextnpm package

Package

Release notes Compare versions Version history

Package linksRepository View on npm

Latest tag16.3.6

PackagesnpmCompare versions

next

The React Framework

Latest 16.3.63,958 published versionsvercel/next.js

Loading comparison…

Choose your update

Your version

Target version

Include prereleases

1 release to review

7 May 2026 · Newest first

0
Major: 0
Minor: 1
Patch

Release notes available: 1
Commit history only: 0
History missing: 0

Last checked 26 Sept 2026, 23:42 UTC

On this page1

Showing 1 of 1 releases. Full release notes.

16.2.6

7 May 2026GitHub Release

Signals highlight changes worth reviewing. They cannot determine whether your application is affected.

Note

This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)
Fix fallback route params case in app-page handler (#91737)
Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
Patch setHeader for direct route handlers (#93101)
Include deployment id in cacheHandlers keys (#93453)
Fix double-encoding of URL pathname parts in client param parsing (#93491)