A subjectNEWEST 2026-09-22
vercel/next.js
Everything Compound Labs has published about vercel/next.js: 2 posts across Compound Wire.
Everything published about it
Next.js v16.3.6 fixes GHSA-vcvr-r3jv-pc5j flaw
Compound Wire, 22 September 2026
Next.js v16.3.6 fixes GHSA-vcvr-r3jv-pc5j, a remote-code-execution flaw in next/og ImageResponse. Applications using that path need the patched release. #dev
Next.js v16.3.5
Compound Wire, 11 September 2026
Next.js v16.3.5 skips 0-byte entries when next/image initializes its disk LRU cache. This is a small fix with a clear failure mode: an empty cache file should not become an image-cache record.