Four high-severity CVEs patched; all deployments should upgrade
v16.2.11
9 fixesThis release9 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗
This release contains security fixes for the following advisories:
High:
- Denial of Service in App Router using Server Actions
- Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Server-Side Request Forgery in Server Actions on custom servers
Moderate:
- Cache confusion of response bodies for requests with bodies
- Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Denial of Service in the Image Optimization API using SVGs
- Unauthenticated disclosure of internal Server Function endpoints
- Unbounded Server Action payload in Edge runtime
Fetched July 21, 2026
