Sourced from next's releases.
v16.1.5
Please refer the following changelogs for more information about this security release:
https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864
v16.1.4
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- Only filter next config if experimental flag is enabled (#88733)
Credits
Huge thanks to
@mischnicfor helping!v16.1.3
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- Fix linked list bug in LRU deleteFromLru (#88652)
- Fix relative same host redirects in node middleware (#88253)
Credits
Huge thanks to
@acdliteand@ijjkfor helping!v16.1.2
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- Turbopack: Update to swc_core v50.2.3 (#87841) (#88296)
- Fixes a crash when processing mdx files with multibyte characters. (#87713)
- Turbopack: mimalloc upgrade and enabling it on musl (#88503) (#87815) (#88426)
- Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.
- Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.
Credits
Huge thanks to
@mischnicfor helping!
acba4a6
v16.1.5e1d1fc6
Add maximum size limit for postponed body parsing (#88175)500ec83
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)1caaca3
feat(next/image)!: add images.maximumResponseBody config
(#88183)522ed84
Sync DoS mitigations for React Flight8cad197
[backport][cna] Ensure created app is not considered the workspace root
in pn...2718661
Backport/docs fixes (#89031)5333625
Backport/docs fixes 16.1.5 (#88916)60de6c2
v16.1.45f75d22
backport: Only filter next config if experimental flag is enabled (#88733)
(#...