Next.js security patches lead a week of framework fixes and Expo simulator upgrades

Critical security patches top the week

The most significant development this week is the Next.js v16.3.3 security release, which patches two critical unauthenticated remote code execution vulnerabilities. The first affects Windows-hosted servers, while the second targets the Image Optimization API when processing AVIF files. Given the "critical" severity rating and the unauthenticated nature of both exploits, all production deployments should upgrade immediately. The Next.js v15.5.24 release addresses the same two vulnerabilities for teams still on the v15 line, ensuring both current and legacy users have a patched path forward.

Canary progress: Cache Components and image optimization fixes

Beyond security, the canary channel saw notable feature work. Next.js v16.4.0-canary.10 introduces a Cache Components option to create-next-app and officially deprecates React 18 support in the Pages Router. It also shortens CSS module class names in Turbopack and widens chunk ident hashes — small but meaningful bundle size and caching improvements. The v16.4.0-canary.9 build takes a stricter stance on image handling by rejecting non-2xx internal responses and re-enables AVIF optimization after the temporary disable in canary.7. It also stabilizes several render-time bailout errors by replacing them with ReactDOM.browser behind a flag, reducing confusing error output in production.

Turbopack and routing refinements

Several canary builds focused on correctness under the hood. v16.4.0-canary.8 fixes Turbopack resolution through chained symlinks and ensures /-rooted imports resolve from the project directory — a subtle but critical fix for monorepo setups. v16.4.0-canary.7 addresses ISR misses caused by backslashes in segments on Windows deployments and includes a batch of wasm compatibility fixes across SWC and Turbopack. The v16.4.0-canary.6 build fixes the metadata prefetch cache key for search params, preventing stale metadata when query strings change. Earlier in the week, v16.4.0-canary.5 was purely internal, and v16.4.0-canary.4 added a types entrypoint for next/cache-handlers and turned off adapter route collapses by default.

EAS CLI: simulator ergonomics and build caching

On the Expo side, EAS CLI v23.0.0 is a major release that renames the simulator preview session type from --type serve-sim to --type web-preview-only. It also caches CocoaPods dependencies between iOS builds — a meaningful CI time saver — and adds EAS_BUN_FILTER_WORKSPACE for selective bun installs. The EAS CLI v22.6.0 release adds an opt-in --max-idle-time-minutes flag for auto-terminating idle simulator sessions and an experimental --resource-class flag, plus worker-side SSH session helpers for the build lifecycle.

While the canary builds iterate, the standout takeaway for most teams remains the security patch: if you're on Next.js 15 or 16, upgrade to the patched versions this week.