# Next.js: what changed from 15 to 16 - Product: Next.js (https://whatsnew.fyi/product/next-js) - Vendor: Vercel - Range: changelog entries numbered after v15.5.25 up to and including v16.3.4, stable releases only - Entries below: 7 releases (newest first) - Resolved: 15 is v15.5.25 and 16 is v16.3.4, the newest stable release of each major we track - Carrying security changes: 3 · CVEs mentioned: 1 · Mentioning breaking changes: 0 · Removing or deprecating something: 0 - Page: https://whatsnew.fyi/product/next-js/compare/15...16 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## What changed (57 changes, grouped by kind) ### Added #### v16.3.0 (2026-08-03) - Add importModule() support to webpack loaders in Turbopack - Add per-slot error attribution for instant validation using slot markers and config depth preference - Add module count field to module graph tracing spans - Add --persistent-caching flag for filesystem-backed cache in turbopack-cli - Add next internal post-build CLI command for Turbopack database compaction - Add useOffline flag with offline retry behavior ### Changed #### v16.3.4 (2026-08-31) - Re-enable AVIF Image Optimization #### v16.3.2 (2026-08-21) - Authenticate Turborepo remote caching with OIDC instead of a static PAT #### v16.3.1 (2026-08-13) - Turbopack: add turbopack_ecmascript and turbopack_wasm's embedded FS to internal_assets_conditions - Turbopack: collapse nested promises in the analyzer - Allow literal exports in 'use cache' files - Retain fewer stale cache versions and use a TTL, plus the mtime fallback #### v16.3.0 (2026-08-03) - Normalize encoded dynamic placeholders in app routes - Update tokio from 1.43.0 to 1.47.3 - Enable server HMR for app route handlers in Turbopack - Skip loadBindings() Lightning CSS check during next start - Rename /_next/webpack-hmr to /_next/hmr - Handle encoded params further - Switch from base40 to base38 hash encoding in Turbopack ### Fixed #### v16.3.4 (2026-08-31) - Fix infinite recursion in testmode passthrough fetch - Fix build error when aliasing typescript to @typescript/typescript6 - Fix unset crossOrigin in Turbopack manifests #### v16.3.2 (2026-08-21) - Scope app-entry export validation to files inside the app directory - Fix catch-all index page being served for every other slug - Turbopack: don't trace embedded WASM loader helpers - Turbopack: retain conditions when replacing resolve request keys - Fix Turbopack worker chunk loading with asset prefix #### v16.3.1 (2026-08-13) - Turbopack: don't strip async-module runtime from shared runtime chunks - Preserve image response after optimization in next/image - Fix missing styled-jsx styles in Pages Router SSR on adapter builds - Turbopack: fix HMR for dynamic imports evaluated from layouts - Restore the live headers() view of the incoming request - Keep the dev validation worker alive across HMR updates - Discard only cache entries that predate a tag revalidation, and reuse completed entries - Encode the cache item name built by unstable_cache - Fix Nav Inspector request loop on repeat captures - Fix optimistic routing bugs leading to repeated prefetch loops - Revert i18n localization change for dynamic Pages API routes #### v16.3.0 (2026-08-03) - Fix invalid HTML response for route-level RSC requests in deployment adapter - Restore Content-Length and ETag for /_next/data/ JSON responses in pages router - Fix missing route in otel spans without base-server - Fix layout segment optimization by moving app-page imports to server-utility transition - Fix server actions in standalone mode with cacheComponents - Fix adapter outputs for dynamic metadata routes #### v16.2.12 (2026-07-25) - Support TypeScript 7 ### Security #### v16.3.3 (2026-08-25) - Fix unauthenticated remote code execution on windows-hosted servers - Fix unauthenticated remote code execution in Image Optimization API when AVIF files are used #### v16.3.0 (2026-08-03) - Update vendored lodash to 4.17.23 to fix CVE-2025-13465 #### v16.2.11 (2026-07-21) - Fixed Denial of Service in App Router using Server Actions - Fixed Middleware / Proxy bypass in App Router applications using Turbopack and single locale - Fixed Server-Side Request Forgery in rewrites via attacker-controlled destination hostname - Fixed Server-Side Request Forgery in Server Actions on custom servers - Fixed Cache confusion of response bodies for requests with bodies - Fixed Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences - Fixed Denial of Service in the Image Optimization API using SVGs - Fixed unauthenticated disclosure of internal Server Function endpoints - Fixed unbounded Server Action payload in Edge runtime ## Release notes ### v16.3.4 - Date: 2026-08-31 - Version: v16.3.4 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.3.4 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.3.4 - **changed** — Re-enable AVIF Image Optimization - **fixed** — Fix infinite recursion in testmode passthrough fetch - **fixed** — Fix build error when aliasing typescript to @typescript/typescript6 - **fixed** — Fix unset crossOrigin in Turbopack manifests Follow-up release to [v16.3.3](https://github.com/vercel/next.js/releases/tag/v16.3.3) re-enabling AVIF Image Optimization ([#97949](https://github.com/vercel/next.js/pull/97949)). The following bug fixes have been backported. It does **not** include all pending features/changes on canary. - testmode: Fix infinite recursion in testmode passthrough fetch (#97691) - Fix build error when aliasing typescript to @typescript/typescript6 (#97997) - Fix unset crossOrigin in Turbopack manifests (#97930) ###### Credits Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping! ### v16.3.3 - Date: 2026-08-25 - Version: v16.3.3 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.3.3 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.3.3 - **security** — Fix unauthenticated remote code execution on windows-hosted servers - **security** — Fix unauthenticated remote code execution in Image Optimization API when AVIF files are used This release contains security fixes for the following advisories: Critical: - [Unauthenticated Remote Code Execution on windows-hosted servers](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36) - [Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4) ### v16.3.2 - Date: 2026-08-21 - Version: v16.3.2 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.3.2 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.3.2 - **fixed** — Scope app-entry export validation to files inside the app directory - **fixed** — Fix catch-all index page being served for every other slug - **fixed** — Turbopack: don't trace embedded WASM loader helpers - **fixed** — Turbopack: retain conditions when replacing resolve request keys - **fixed** — Fix Turbopack worker chunk loading with asset prefix - **changed** — Authenticate Turborepo remote caching with OIDC instead of a static PAT > [!NOTE] > This release is backporting bug fixes. It does **not** include all pending features/changes on canary. ###### Core Changes - [backport] Scope app-entry export validation to files inside the app directory (#97357) - [backport] Fix catch-all index page being served for every other slug (#97416) - [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463) - [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453) - [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419) - [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603) ###### Credits Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping! ### v16.3.1 - Date: 2026-08-13 - Version: v16.3.1 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.3.1 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.3.1 - **fixed** — Turbopack: don't strip async-module runtime from shared runtime chunks - **changed** — Turbopack: add turbopack_ecmascript and turbopack_wasm's embedded FS to internal_assets_conditions - **changed** — Turbopack: collapse nested promises in the analyzer - **fixed** — Preserve image response after optimization in next/image - **fixed** — Fix missing styled-jsx styles in Pages Router SSR on adapter builds - **fixed** — Turbopack: fix HMR for dynamic imports evaluated from layouts - **fixed** — Restore the live headers() view of the incoming request - **changed** — Allow literal exports in 'use cache' files - **fixed** — Keep the dev validation worker alive across HMR updates - **fixed** — Discard only cache entries that predate a tag revalidation, and reuse completed entries - **fixed** — Encode the cache item name built by unstable_cache - **fixed** — Fix Nav Inspector request loop on repeat captures - **fixed** — Fix optimistic routing bugs leading to repeated prefetch loops - **changed** — Retain fewer stale cache versions and use a TTL, plus the mtime fallback - **fixed** — Revert i18n localization change for dynamic Pages API routes ##### What's Changed * [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in https://github.com/vercel/next.js/pull/96653 * [16.x] [turbopack] Add `turbopack_ecmascript` and `turbopack_wasm`'s embeded FS to `internal_assets_conditions` by @lukesandberg in https://github.com/vercel/next.js/pull/96655 * [16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in https://github.com/vercel/next.js/pull/96675 * [16.x] fix(next/image): preserve image response after optimization by @styfle in https://github.com/vercel/next.js/pull/96733 * [16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in https://github.com/vercel/next.js/pull/96900 * [backport] Bump @swc/helpers by @mischnic in https://github.com/vercel/next.js/pull/96885 * [backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in https://github.com/vercel/next.js/pull/97308 * [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in https://github.com/vercel/next.js/pull/97302 * [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in https://github.com/vercel/next.js/pull/97317 * [backport] Restore the live `headers()` view of the incoming request by @unstubbable in https://github.com/vercel/next.js/pull/97311 * [backport] Allow literal exports in `'use cache'` files by @unstubbable in https://github.com/vercel/next.js/pull/97312 * [backport] Keep the dev validation worker alive across HMR updates by @unstubbable in https://github.com/vercel/next.js/pull/97315 * [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in https://github.com/vercel/next.js/pull/97314 * [backport] Encode the cache item name built by `unstable_cache` by @unstubbable in https://github.com/vercel/next.js/pull/97313 * [16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in https://github.com/vercel/next.js/pull/97258 * [backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in https://github.com/vercel/next.js/pull/97328 * [backport] Fix Nav Inspector request loop on repeat captures by @acdlite in https://github.com/vercel/next.js/pull/97326 * [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in https://github.com/vercel/next.js/pull/97325 * [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in https://github.com/vercel/next.js/pull/97304 * [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in https://github.com/vercel/next.js/pull/97330 **Full Changelog**: https://github.com/vercel/next.js/compare/v16.3.0...v16.3.1 ### v16.3.0 - Date: 2026-08-03 - Version: v16.3.0 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.3.0 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.3.0 - **security** — Update vendored lodash to 4.17.23 to fix CVE-2025-13465 - **fixed** — Fix invalid HTML response for route-level RSC requests in deployment adapter - **changed** — Normalize encoded dynamic placeholders in app routes - **fixed** — Restore Content-Length and ETag for /_next/data/ JSON responses in pages router - **changed** — Update tokio from 1.43.0 to 1.47.3 - **changed** — Enable server HMR for app route handlers in Turbopack - **changed** — Skip loadBindings() Lightning CSS check during next start - **added** — Add importModule() support to webpack loaders in Turbopack - **changed** — Rename /_next/webpack-hmr to /_next/hmr - **added** — Add per-slot error attribution for instant validation using slot markers and config depth preference - **changed** — Handle encoded params further - **fixed** — Fix missing route in otel spans without base-server - **fixed** — Fix layout segment optimization by moving app-page imports to server-utility transition - **fixed** — Fix server actions in standalone mode with cacheComponents - **fixed** — Fix adapter outputs for dynamic metadata routes - **added** — Add module count field to module graph tracing spans - **added** — Add --persistent-caching flag for filesystem-backed cache in turbopack-cli - **added** — Add next internal post-build CLI command for Turbopack database compaction - **changed** — Switch from base40 to base38 hash encoding in Turbopack - **added** — Add useOffline flag with offline retry behavior ###### Core Changes - Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558 - Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541 - Normalize encoded dynamic placeholders in app routes: #91603 - Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304 - Update tokio from 1.43.0 to 1.47.3: #90945 - [turbopack] Simplify snapshotting logic: #91178 - Turbopack: enable server HMR for app route handlers: #91466 - turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497 - [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636 - Skip loadBindings() Lightning CSS check during next start: #91538 - turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461 - Turbopack: Add importModule() support to webpack loaders: #89630 - turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640 - turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524 - feat(node-streams): add config flag, define-env, and env precedence test: #90427 - Rename /_next/webpack-hmr to /_next/hmr: #91415 - Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610 - Handle encoded params further: #91627 - [turbopack] Respect `{eval:true}` in worker_threads constructors: #91666 - Fix missing route in otel spans without base-server: #91665 - [turbopack] Optimize compaction cpu usage: #91468 - Fix layout segment optimization: move app-page imports to server-utility transition: #91701 - Fix server actions in standalone mode with `cacheComponents`: #91711 - turbo-persistence: remove Unmergeable mmap advice: #91713 - turbopack: move "compact database" tracing span to backend layer: #91693 - Turbopack: lazy require metadata and handle TLA: #91705 - Fix adapter outputs for dynamic metadata routes: #91680 - Turbopack: fix webpack loader runner layer: #91727 - [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699 - Add module count field to module graph tracing spans: #91697 - turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657 - Turbopack: pull in updated vercel/nft tests: #91651 - [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477 - [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320 - [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438 - Avoid deprecated TS node10 moduleResolution defaults: #91847 - [turbopack] Rebuild the docker build scripts: #91799 - Fix TS6 baseUrl deprecation for extended tsconfig: #91855 - Add `next internal post-build` CLI command for Turbopack database compaction: #91336 - Turbopack: Define `Effect` as a trait instead of a closure: #89080 - Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133 - turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742 - Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832 - Use charCodeAt for normalizePathTrailingSlash: #91380 - Turbopack: Only patch lockfile when bindings fails to load: #91379 - [create-next-app] Skip interactive prompts when CLI flags are provided: #91840 - [devtools] Make instant navs panel draggable: #91914 - [Segment Bundling] Bundle static prefetches based on size: #91439 - turbo-tasks-backend: assert non-transient task_ids in track_modification: #91924 - fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #91856 - turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #91725 - turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #91576 - [cna] Upgrade to Biome 2.4 with Tailwind support: #86065 - [devtools] Show `AggregateError.errors` in the error overlay: #91835 - Narrow the opengraph-image _[Truncated at 4000 characters — full notes: https://github.com/vercel/next.js/releases/tag/v16.3.0]_ ### v16.2.12 - Date: 2026-07-25 - Version: v16.2.12 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.2.12 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.2.12 - **fixed** — Support TypeScript 7 ##### What's Changed * Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031 * [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831 **Full Changelog**: https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12 ### v16.2.11 - Date: 2026-07-21 - Version: v16.2.11 - Original notes: https://github.com/vercel/next.js/releases/tag/v16.2.11 - Permalink: https://whatsnew.fyi/product/next-js/releases/v16.2.11 - **security** — Fixed Denial of Service in App Router using Server Actions - **security** — Fixed Middleware / Proxy bypass in App Router applications using Turbopack and single locale - **security** — Fixed Server-Side Request Forgery in rewrites via attacker-controlled destination hostname - **security** — Fixed Server-Side Request Forgery in Server Actions on custom servers - **security** — Fixed Cache confusion of response bodies for requests with bodies - **security** — Fixed Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences - **security** — Fixed Denial of Service in the Image Optimization API using SVGs - **security** — Fixed unauthenticated disclosure of internal Server Function endpoints - **security** — Fixed unbounded Server Action payload in Edge runtime This release contains security fixes for the following advisories: High: - [Denial of Service in App Router using Server Actions](https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj) - [Middleware / Proxy bypass in App Router applications using Turbopack and single locale](https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24) - [Server-Side Request Forgery in rewrites via attacker-controlled destination hostname](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4) - [Server-Side Request Forgery in Server Actions on custom servers](https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x) Moderate: - [Cache confusion of response bodies for requests with bodies](https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742) - [Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q) - [Denial of Service in the Image Optimization API using SVGs](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch) - [Unauthenticated disclosure of internal Server Function endpoints](https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp) - [Unbounded Server Action payload in Edge runtime](https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3)