Next.js v16.2.5 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: nextjs · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

$ npm install --save-exact [email protected]

📄 .MD

🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

Next.js v16.2.5. Source highlight: This release contains security fixes and backported bug fixes. It does **not** include all pending features/changes on canary.

Visit Next.js Official Site ↗ Official Release Source ↗ All Next.js Releases 📡 Next.js RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

🔧 Bug Fixes & Patches (6)

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

📄 View Raw Release Notes (Original Developer Log)

> [!NOTE] > This release contains security fixes and backported bug fixes. It does **not** include all pending features/changes on canary. ### Security Fixes The following advisories have been addressed: **High:** - [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) - [GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) - [GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx) - [GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv) - [GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r) - [GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5) **Moderate:** - [GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q) - [GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h) - [GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh) - [GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7) **Low:** - [GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949) - [GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq) ### Core Changes - fix: preserve HTTP access fallbacks during prerender recovery (#92231) - Fix fallback route params case in app-page handler (#91737) - Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541) - Patch setHeader for direct route handlers (#93101) - Include deployment id in `cacheHandlers` keys (#93453) - Fix double-encoding of URL pathname parts in client param parsing (#93491)

← Older Version Next.js v15.5.16 Newer Version → Next.js v16.2.6