Note
This release is backporting bug fixes. It does not include all pending features/changes on canary.
Huge thanks to @ztanner for helping!
Fetched March 31, 2026
This release contains security fixes for the following advisories: High: - GHSA-8h8q-6873-q5fj: Denial of Service with Server Components -…
Vercel · Next.jsThis release contains security fixes for the following advisories: High: - GHSA-8h8q-6873-q5fj: Denial of Service with Server Components -…
Vercel · Next.jsBumped Next.js devDependency to 15.5.18 to pick up the fix for GHSA-26hh-7cqf-hhc6, a high-severity (CVSS 7.5) middleware/proxy bypass vuln…
Clerk · JavaScript SDKThis emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes…
Cloudflare · Application Security