TL;DR

Turbopack continues to receive significant improvements, notably in its analyzer for more accurate code analysis and faster build times, alongside ongoing fixes for edge cases and enhanced tooling support.

New

• Instant Navigation Improvements: The instant navigation overlay has been redesigned with separate tabs for Errors and Insights, improving debugging.
• Image Optimization: An experimental imgOptOperationCache flag has been added for image optimization, potentially improving performance.
• Docker Deployment Guide: Documentation for deploying with the new Next.js Docker official guide has been updated.

Fixes Worth Knowing

• Fixes address issues with import.meta.url on Windows when using Turbopack.
• Resolved a bug causing incorrect search parameters to be stored in the cache.
• Improved handling of short-circuit evaluation in the Turbopack analyzer for more accurate builds.
• Fixed an issue where the debug channel wasn’t closing correctly.

Before You Upgrade

If you are using Turbopack, be aware that the analyzer has undergone substantial changes. While generally improving performance, it’s good practice to review your build output after upgrading to ensure expected behavior.

TL;DR

Next.js now correctly handles FormData submissions and resolves issues with caching, rewrites, and server actions, improving application stability.

Fixes Worth Knowing

• Resolved an issue where FormData entries were being dropped during submission.
• Fixed hydration failures when serving pages from an HTTP cache.
• Corrected a bug causing query corruption with basePath and rewrites.
• Server actions with middleware rewrites no longer cause forwarding loops.
• Non-ASCII characters are now properly encoded in cache tags.

Before You Upgrade

Ensure your project uses the latest playwright-core version to avoid potential issues with request failures.

TL;DR

This release addresses multiple critical security vulnerabilities in Next.js, impacting Server Components, middleware, and caching, requiring immediate attention.

Breaking

• Server Component Security: Several fixes address denial of service and cache poisoning vulnerabilities in Server Components (code that runs on the server).
• Middleware Bypass: Multiple vulnerabilities were resolved preventing attackers from bypassing middleware and proxy protections (security layers).
• WebSocket Security: A server-side request forgery vulnerability in WebSocket upgrades has been patched.

Fixes Worth Knowing

• XSS Prevention: Cross-site scripting (XSS) vulnerabilities were addressed in App Router applications using CSP nonces and beforeInteractive scripts.
• Image Optimization: A denial of service vulnerability in the Image Optimization API has been fixed.

Before You Upgrade

Update to this version as soon as possible to mitigate the identified security risks. No specific migration steps are required beyond a standard Next.js upgrade.

TL;DR

Next.js has been patched to address critical security vulnerabilities (CVE-2025-59471, CVE-2025-59472, CVE-2026-23864) that could allow for denial of service.

Before You Upgrade

Update to this canary release as soon as possible to mitigate the identified security risks.

TL;DR

Next.js has been updated with critical security patches; immediate upgrades are recommended to protect your applications.

Fixes Worth Knowing

Security vulnerabilities have been addressed, protecting against potential exploits.

Before You Upgrade

Review the Next.js Security Update (https://nextjs.org/blog/security-update-2025-12-11) for details on the patched vulnerabilities and their potential impact.

TL;DR

Next.js now includes a critical security patch (CVE-2025-29927) and improved handling of subrequests, ensuring consistent behavior between Edge and Node.js environments.

Fixes Worth Knowing

• Subrequest handling is now consistent across Edge and Node.js deployments (server-side rendering).
• Security vulnerability (CVE-2025-29927) addressed, improving application security.

Before You Upgrade

Update to this version to apply the critical security patch.

TL;DR

Next.js now includes a critical security patch (CVE-2025-29927) and improved handling of middleware subrequests, ensuring more reliable behavior across Edge and Node.js environments.

Fixes Worth Knowing

• Resolved an issue with middleware subrequests, improving reliability when using middleware (request handling in Next.js).
• Improved subrequest handling consistency between Edge and Node.js environments.

TL;DR

Next.js now disables automatic fetch caching by default, requiring explicit opt-in for improved control and predictability, alongside continued improvements to the experimental app router (PPR).

Breaking

• Disable Automatic Fetch Caching: Automatic caching of fetch requests is now disabled. You must now explicitly opt-in to caching using the cache property in your fetch options. (Data fetching)

New

• Turbopack Client Entry: A dedicated client entry point has been added for Turbopack builds, potentially improving performance. (Build tool)
• Experimental PPR Improvements: The experimental app router (PPR - Parallel Routes & Rendering) has seen numerous fixes and is now more stable, with the canary requirement removed. (App Router)

Fixes Worth Knowing

• Fixed issues with prefetch data routes not always being added when using PPR.
• Resolved a crash in dev mode for edge runtime pages using unstable_after.
• Corrected issues with metadata routes skipping static optimization.
• Improved handling of typeof window in Turbopack builds.

Before You Upgrade

• Review your fetch calls and explicitly manage