Next.js patches two critical RCEs as its canary line rebuilds caching and bundling

Critical RCE fixes land across two Next.js lines

The week's most urgent news is a pair of unauthenticated remote code execution vulnerabilities in Next.js, patched simultaneously on the current and previous major lines. Anyone hosting on Windows should treat this as a drop-everything upgrade: Next.js closed an RCE reachable on Windows-hosted servers, and the same fix is available to projects still on the older line through the 15.5 patch for Windows-hosted deployments. The second advisory is broader in reach, since it doesn't depend on the host OS — the Image Optimization API could be exploited when AVIF files are involved, an issue the 16.x line fixed and the 15.x line fixed in parallel. If you can't upgrade immediately, disabling AVIF optimization is the interim mitigation. Notably, the canary branch had re-enabled AVIF image optimization only a day before these advisories, after disabling it earlier in the week — a reminder that the image path was under active churn.

Canary groundwork for caching and routing

Behind the security work, the 16.4 canary line kept up a steady drumbeat of platform changes. Caching got the most attention: Cache Components arrived as an option in create-next-app, alongside a deprecation of React 18 support in the Pages Router, and use-cache entries grew more granular cache keys. A new types entrypoint for next/cache-handlers gives adapter authors something typed to build against.

Routing and resolution fixes filled out the rest. Optimistic routing for encoded dynamic params and intercepted route params after Proxy rewrites was corrected, metadata prefetch cache keys for search params were fixed, and ISR no longer misses when backslashes appear in segments on Windows deployments. Turbopack specifically got resolution through chained symlinks and /-rooted imports, which should unblock monorepo setups that lean on linked packages. Tooling around upgrades also improved: codemods now transform .mjs files and honor non-interactive mode, making scripted migrations viable.

Svelte rounds out its server and context APIs

Svelte's release was smaller but substantive for people writing server-rendered or context-heavy components. Svelte now exports RenderOutput, SyncRenderOutput, Csp, and Sha256Source from svelte/server, which lets integrations type their rendered output and CSP plumbing without reaching into internals. The same release added a has function to createContext for checking whether a context exists before consuming it, defaultValue support on <select> to match the behavior long available on inputs, and getOrInsert and getOrInsertComputed on SvelteMap.

Expo's EAS CLI cuts a major version

The EAS CLI crossed into v23 with a breaking rename: the simulator's preview-only session type is now --type web-preview-only, so any CI scripts passing serve-sim need updating. The same release caches CocoaPods dependencies between iOS builds — a real time saver on repeat builds — and adds EAS_BUN_FILTER_WORKSPACE for selective bun installs. Just before the major bump, the CLI gained an opt-in idle timeout that stops simulator sessions automatically and an experimental resource-class flag, giving teams a way to cap runaway simulator costs.