{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_F7Cj6uzlr0Z6gILuSpBTM","weekStart":"2026-08-24","title":"Next.js security patches lead a week of framework fixes and Expo simulator upgrades","intro":"Next.js released critical security patches for unauthenticated RCE vulnerabilities across v16.3.3 and v15.5.24, while canary builds introduced Cache Components and stabilized image optimization. EAS CLI added simulator idle timeout and resource class flags.","body":"### Critical security patches top the week\n\nThe most significant development this week is the [Next.js v16.3.3 security release](/release/rel_szezifiwmX4wDfGw-5u1Z-next-js-v16-3-3-patches-two-critical-unauthenticated-rce-vulnerabilities), which patches two critical unauthenticated remote code execution vulnerabilities. The first affects Windows-hosted servers, while the second targets the Image Optimization API when processing AVIF files. Given the \"critical\" severity rating and the unauthenticated nature of both exploits, all production deployments should upgrade immediately. The [Next.js v15.5.24 release](/release/rel_fKHCmzeMe6DmiS2IlwGee-next-js-v15-5-24-patches-two-critical-unauthenticated-rce-vulnerabilities) addresses the same two vulnerabilities for teams still on the v15 line, ensuring both current and legacy users have a patched path forward.\n\n### Canary progress: Cache Components and image optimization fixes\n\nBeyond security, the canary channel saw notable feature work. [Next.js v16.4.0-canary.10](/release/rel_p8qh_KDJKXDTe5EViUCUc-next-js-v16-4-0-canary-10-launches-cache-components-and-deprecates-react-18) introduces a Cache Components option to `create-next-app` and officially deprecates React 18 support in the Pages Router. It also shortens CSS module class names in Turbopack and widens chunk ident hashes — small but meaningful bundle size and caching improvements. The [v16.4.0-canary.9](/release/rel_UV_8Ywx2KajChp-NrbWdv-next-js-v16-4-0-canary-9-rejects-non-2xx-image-responses-and-stabilizes-bailout) build takes a stricter stance on image handling by rejecting non-2xx internal responses and re-enables AVIF optimization after the temporary disable in canary.7. It also stabilizes several render-time bailout errors by replacing them with `ReactDOM.browser` behind a flag, reducing confusing error output in production.\n\n### Turbopack and routing refinements\n\nSeveral canary builds focused on correctness under the hood. [v16.4.0-canary.8](/release/rel_flFQVnSUTCWvkQMAiJuqS-next-js-v16-4-0-canary-8-fixes-turbopack-symlink-and-root-import-resolution) fixes Turbopack resolution through chained symlinks and ensures `/`-rooted imports resolve from the project directory — a subtle but critical fix for monorepo setups. [v16.4.0-canary.7](/release/rel_-i87hsrv4fJkGF4-M9ZfB-next-js-v16-4-0-canary-7-fixes-isr-with-windows-backslashes-and-wasm) addresses ISR misses caused by backslashes in segments on Windows deployments and includes a batch of wasm compatibility fixes across SWC and Turbopack. The [v16.4.0-canary.6](/release/rel_TX0HLLfEaAnO-O_1XLTYx-next-js-v16-4-0-canary-6-fixes-metadata-prefetch-cache-key-for-search-params) build fixes the metadata prefetch cache key for search params, preventing stale metadata when query strings change. Earlier in the week, [v16.4.0-canary.5](/release/rel_Drpra3UwqGRt7SgDtMsw3-next-js-v16-4-0-canary-5-internal-release) was purely internal, and [v16.4.0-canary.4](/release/rel_XFD19g_33_kjRUm0K4KTY-next-js-v16-4-0-canary-4-adds-cache-handlers-types-entrypoint) added a types entrypoint for `next/cache-handlers` and turned off adapter route collapses by default.\n\n### EAS CLI: simulator ergonomics and build caching\n\nOn the Expo side, [EAS CLI v23.0.0](/release/rel_a2_io8qQWRmdNf-bHJFuH-eas-cli-v23-0-0-renames-serve-sim-session-type-caches-cocoapods-deps) is a major release that renames the simulator preview session type from `--type serve-sim` to `--type web-preview-only`. It also caches CocoaPods dependencies between iOS builds — a meaningful CI time saver — and adds `EAS_BUN_FILTER_WORKSPACE` for selective bun installs. The [EAS CLI v22.6.0](/release/rel_hZThk8BWRABKqMDgdYR5D-eas-cli-v22-6-0-adds-idle-timeout-and-resource-class-flags-to-eas-simulator) release adds an opt-in `--max-idle-time-minutes` flag for auto-terminating idle simulator sessions and an experimental `--resource-class` flag, plus worker-side SSH session helpers for the build lifecycle.  \n\nWhile the canary builds iterate, the standout takeaway for most teams remains the security patch: if you're on Next.js 15 or 16, upgrade to the patched versions this week.","releaseIds":["rel_szezifiwmX4wDfGw-5u1Z","rel_fKHCmzeMe6DmiS2IlwGee","rel_p8qh_KDJKXDTe5EViUCUc","rel_UV_8Ywx2KajChp-NrbWdv","rel_flFQVnSUTCWvkQMAiJuqS","rel_-i87hsrv4fJkGF4-M9ZfB","rel_TX0HLLfEaAnO-O_1XLTYx","rel_Drpra3UwqGRt7SgDtMsw3","rel_XFD19g_33_kjRUm0K4KTY","rel_a2_io8qQWRmdNf-bHJFuH","rel_hZThk8BWRABKqMDgdYR5D"],"releaseCount":14,"generatedAt":"2026-08-31T06:32:00.945Z","releases":[{"id":"rel_szezifiwmX4wDfGw-5u1Z","title":"Next.js v16.3.3 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_szezifiwmX4wDfGw-5u1Z-critical-rce-vulnerabilities-patched-upgrade-advised","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_fKHCmzeMe6DmiS2IlwGee","title":"Next.js v15.5.24 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_fKHCmzeMe6DmiS2IlwGee-two-critical-unauthenticated-rce-flaws-patched","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_p8qh_KDJKXDTe5EViUCUc","title":"Next.js v16.4.0-canary.10 launches Cache Components and deprecates React 18","path":"/release/rel_p8qh_KDJKXDTe5EViUCUc-cache-components-added-react-18-deprecated-on-pages-router","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_UV_8Ywx2KajChp-NrbWdv","title":"Next.js v16.4.0-canary.9 rejects non-2xx image responses and stabilizes bailout errors","path":"/release/rel_UV_8Ywx2KajChp-NrbWdv-image-responses-restricted-to-2xx-bailout-errors-behind-reactdom-browser","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_flFQVnSUTCWvkQMAiJuqS","title":"Next.js v16.4.0-canary.8 fixes Turbopack symlink and root import resolution","path":"/release/rel_flFQVnSUTCWvkQMAiJuqS-turbopack-resolves-symlinks-and-root-imports-typescript-tracing-fixed","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_-i87hsrv4fJkGF4-M9ZfB","title":"Next.js v16.4.0-canary.7 fixes ISR with Windows backslashes and wasm compatibility","path":"/release/rel_-i87hsrv4fJkGF4-M9ZfB-isr-backslash-handling-fixed-on-windows-wasm-build-issues-resolved","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_TX0HLLfEaAnO-O_1XLTYx","title":"Next.js v16.4.0-canary.6 fixes metadata prefetch cache key for search params","path":"/release/rel_TX0HLLfEaAnO-O_1XLTYx-turbopack-outputs-cache-fix-realtime-translate","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_Drpra3UwqGRt7SgDtMsw3","title":"Next.js v16.4.0-canary.5 internal release","path":"/release/rel_Drpra3UwqGRt7SgDtMsw3-next-js-v16-4-0-canary-5-internal-release","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_XFD19g_33_kjRUm0K4KTY","title":"Next.js v16.4.0-canary.4 adds cache-handlers types entrypoint","path":"/release/rel_XFD19g_33_kjRUm0K4KTY-cache-handlers-types-entrypoint-added","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_a2_io8qQWRmdNf-bHJFuH","title":"EAS CLI v23.0.0 renames serve-sim session type, caches CocoaPods deps","path":"/release/rel_a2_io8qQWRmdNf-bHJFuH-serve-sim-renamed-web-preview-only-cocoapods-cached","org":{"slug":"expo","name":"Expo"},"importance":3},{"id":"rel_hZThk8BWRABKqMDgdYR5D","title":"EAS CLI v22.6.0 adds idle timeout and resource class flags to eas simulator","path":"/release/rel_hZThk8BWRABKqMDgdYR5D-simulator-gets-idle-timeout-resource-class-flag-added","org":{"slug":"expo","name":"Expo"},"importance":2}]}}