Release notes

New Next.js projects now install Next.js ~16.4.3 and React ^19.3.1 instead of 16.2.11. The version range lets new projects pick up patch releases on the 16.4 line automatically.

In 2026 Next.js patched critical remote code execution vulnerabilities in areas such as the Image Optimization API and next/og. Version 16.2.11 misses those patches.

• Next.js Security Update, August 2026 (Next.js)
• Next.js Security Update for a Critical Upstream Issue, September 22, 2026 (Next.js)
• Next.js Security Update, October 14, 2026 (Next.js)

This release does not change existing projects. Upgrade projects on Next.js 16.2 or 16.3 yourself.

pnpm add next@16.4.3 react@19.3.1 react-dom@19.3.1
pnpm add -D eslint-config-next@16.4.3

In new TanStack Start projects, src/start.ts now protects server functions with createCsrfMiddleware. Cross-site requests get a 403.

TanStack Start installs CSRF protection automatically, but not when a project defines its own src/start.ts. The template had that file, so projects that added server functions were left unprotected.

• CSRF Middleware (TanStack Start)

If an existing project has src/start.ts, add the middleware yourself and keep the other entries in your requestMiddleware list.

// src/start.ts
import { createCsrfMiddleware, createStart } from "@tanstack/react-start";
 
const csrfMiddleware = createCsrfMiddleware({
  filter: (ctx) => ctx.handlerType === "serverFn",
});
 
export const startInstance = createStart(() => ({
  requestMiddleware: [csrfMiddleware],
}));