October 2026 was a busy month for anyone running a web product: a new Next.js release, an out-of-band patch for two critical vulnerabilities, then security releases for every supported Node.js line. Here is what matters for owners and their teams.
Next.js 16.4 (October 6)
The headline: the Next.js team now recommends Cache Components for every app. New projects from create-next-app have it on by default, and it becomes the default in Next.js 17.
- ensureStatic guarantees a page or layout stays static and fails the build if dynamic content sneaks in, which keeps server costs down for stores, marketing pages and blogs.
- navigation() and prefetch() give finer control over what is prefetched and what waits for a real visit.
- next upgrade --agent prepares upgrade steps and codemods for a coding agent, then verifies the app still works.
- For every app: a 20–25% smaller Turbopack disk cache, smaller production bundles, and React 19.3 with stable View Transitions.
Urgent security update (October 14)
Next.js 16.4.1 and 15.5.28 close three vulnerabilities: two critical unauthenticated remote-code-execution flaws (in use cache functions returning typed arrays, and in Image Optimization with SVG on glibc Linux), plus a high-severity denial of service through Server Actions.
Node.js closes 10 vulnerabilities (October 21)
Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 issues: 4 high, 3 medium and 3 low. They include a Brotli decoder flaw that could lead to code execution, TLS certificate checks fooled by unusual IP spellings, and a DNS name truncation bug. OpenSSL and Undici were updated too.
What to do now
- Check the Next.js and Node.js versions actually running on your server, not only on a developer's machine.
- Update Next.js to 16.4.1+ (or 15.5.28) and Node.js to the latest release in your line.
- On managed hosting (Vercel, Render and others), check the Node version pinned in project settings.
- Run your tests and check payment pages and forms after updating.
The Evan Code site itself runs Next.js 16.4.2, already past the security fix. If your project needs a review or an upgrade, our Project Review service gives you a clear report of what to do.