Framework
Next.js is an open-source React framework from Vercel offering server-side rendering, routing, and build tooling for web applications.
Next.js released versions 16.4.1 and 15.5.28 on October 14 to fix two unauthenticated code-execution flaws that Vercel rated CVSS 9.5. As of October 15 the caching flaw had no CVE and no workaround, so npm audit may stay quiet and only the upgrade closes it.
Reality
Next.js 15 leaves Maintenance LTS on 21 October 2026, ending its scheduled critical bug fixes and security patches. A dev.to upgrade guide lists Next.js 16 defaults that compile cleanly and still change what users see, including image caching and route-change scrolling.
Reality
AWS Lambda Web Functions run a Hono server without an adapter and allow 128 concurrent requests per environment, a dev.to guide says. Billing, concurrency and endpoint auth differ from Event Functions, so fit needs a check before a backend moves.
Reality
Satori, the JSX-to-SVG step behind Next.js next/og, put external input into SVG unescaped, per a dev.to explainer of CVE-2026-94545. The explainer says code execution would need the injected SVG to corrupt memory in a native parser, while SSRF needs only the injection.
Reality
AWS Lambda now runs port-listening HTTP servers such as Express and Fastify, with up to 128 concurrent requests per environment. Billing moves to CPU time used, while memory is metered for the life of the environment.
Reality
Next.js will ship an out-of-band security update on October 14 for three upstream dependency vulnerabilities, two rated Critical and one High. Until then, the useful preparation is confirming which Next.js build each production app actually serves.
Reality
Next.js 16.4 enables Cache Components by default in new create-next-app projects, ahead of the model becoming the default in Next.js 17. The team now recommends it for every app, so existing App Router code has a release to migrate on before 17.
Reality
Island traced fake ChatGPT, Gemini, Claude and Perplexity ad tools to a phishing operation whose Telegram channel took hundreds of victim submissions. Its targets are agency buyers and admins, whose one login can spend several advertisers' balances.
Reality
Next.js's bundled http-proxy 1.18.1 stamps Content-Length: 0 on chunked DELETE and OPTIONS rewrites, so a hidden second request reaches the backend. Whether it reaches anything sensitive depends on how the next hop frames requests and which internal routes the backend opens to its proxy.
Reality
Satori's SVG escaping flaw exposes Next.js 16.2.0 and every release before 16.3.6 to remote code execution when apps pass attacker input to next/og on Node. The step where app data becomes SVG markup needs the escaping discipline teams already give HTML and SQL.
Reality
Drizzle-kit generated a DROP TABLE ... CASCADE for a table still in production when a developer asked it for two new tables. The developer traces it to schema.ts, drizzle-kit's snapshot and the live database each describing a different schema.
Reality
Satori, the renderer behind next/og, cannot read WOFF2, so one Next.js site commits four Geist .ttf files to set its preview cards in the site's own type. The card takes its logo and palette from source, but its font is a second copy that someone has to keep current.
Reality
Chrome moves to a two-week release cycle on desktop, Android and iOS from version 153, according to a dev.to round-up of DevTools 151 to 153. Web teams get smaller milestones more often, each one another browser version to test against.
Reality
OAI-SearchBot and GPTBot began rendering JavaScript on September 25, 2026, according to IP-verified logs from a Japanese Next.js marketplace. OpenAI has not announced it, so the case rests on prefetch URLs that only a JavaScript run can produce.
Reality
V8's 'is not valid JSON' error quotes the whole response body when it is 20 characters or fewer, according to a developer's tests on Node 24.13. A quote without a trailing ellipsis is the entire reply, so a short error body can be diagnosed from the logged message alone.
Reality
Turbopack, Next.js 16's default bundler, swapped a require.resolve call for an integer module ID at build time and broke a PDF tool that passed every test. Type checks, unit tests and direct calls never run the bundled output, so none of them could see the swap.
Reality
Next.js 15 switched GET Route Handlers from static to dynamic, so handlers written for 14 now run on every request. Version 16 keeps that default and adds a caching mode in which a common 14-era config line becomes an error.
Reality
OpenAI's Node SDK gives each attempt 10 minutes by default, so on Vercel a hung model call is killed at 300 seconds before its catch block can log anything. The call's own limits have to be shorter than every clock in front of it, or the platform ends the request and nothing gets recorded.
Reality
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
Reality
Sparkpix.ai cut its GPT Image 2 humanizer prompt from 2,300 characters to one sentence asking for a photo that looks shot on an iPhone 12 camera. The builder compared the two by eye, and the scoped version now live has not been through that comparison.
Reality