Next.js v16.1.7 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: nextjs · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

$ npm install --save-exact [email protected]

📄 .MD

✨ Features 1 🔧 Bug Fixes 1

⚡ Executive Summary (TL;DR)

Next.js v16.1.7. Source highlight: This release is backporting bug fixes. It does **not** include all pending features/changes on canary.

Visit Next.js Official Site ↗ Official Release Source ↗ All Next.js Releases 📡 Next.js RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (1)

feat(next/image): add lru disk cache and `images.maximumDiskCacheSize` (See: CVE-2026-27980)

🔧 Bug Fixes & Patches (1)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

📄 View Raw Release Notes (Original Developer Log)

> [!NOTE] > This release is backporting bug fixes. It does **not** include all pending features/changes on canary. ### Core Changes - [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194) - Apply server actions transform to node_modules in route handlers (#89380) - ensure `maxPostponedStateSize` is always respected (See: [CVE-2026-27979](https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq)) - feat(next/image): add lru disk cache and `images.maximumDiskCacheSize` (See: [CVE-2026-27980](https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8)) - Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: [CVE-2026-27977](https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36)) - Disallow Server Action submissions from privacy-sensitive contexts by default (See: [CVE-2026-27978](https://github.com/vercel/next.js/security/advisories/GHSA-mq59-m269-xvcx)) - fix: patch http-proxy to prevent request smuggling in rewrites (See: [CVE-2026-29057](https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8)) ### Credits Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

← Older Version Next.js v15.5.12 Newer Version → Next.js v15.5.13