Security update for Next.js and TanStack Start, plus ViraStack Address support

• New Next.js projects now install Next.js ~16.4.3 and React ^19.3.1 instead of 16.2.11, and the version range picks up patch releases on the 16.4 line automatically.
• In new TanStack Start projects, src/start.ts now protects server functions with createCsrfMiddleware, so cross-site requests get a 403.
• The CLI also offers @virastack/address in its tools question, and you can add it with --tools address or add address.

• In 2026 Next.js patched critical remote code execution vulnerabilities in areas such as the Image Optimization API and next/og, and version 16.2.11 misses those patches.
• TanStack Start installs CSRF protection automatically, but not when a project defines its own src/start.ts. The template had that file, so projects that added server functions were left unprotected.
• @virastack/address was added so it can be selected during setup, like the other ViraStack tools.

• August 2026 Security Release (Next.js)
• Next.js Security Update for a Critical Upstream Issue (Next.js)
• Next.js Security Update for Upstream Vulnerabilities (Next.js)
• CSRF Middleware (TanStack Start)

• 670d487 Next.js and React security update
• 7e11e52 TanStack Start CSRF protection
• 8109215 @virastack/address option

This release does not change existing projects. Upgrade projects on Next.js 16.2 or 16.3 yourself. If your TanStack Start project has src/start.ts, add the middleware and keep the other entries in your requestMiddleware list.

pnpm add next@16.4.3 react@19.3.1 react-dom@19.3.1
pnpm add -D eslint-config-next@16.4.3

// src/start.ts
import { createCsrfMiddleware, createStart } from "@tanstack/react-start";
 
const csrfMiddleware = createCsrfMiddleware({
  filter: (ctx) => ctx.handlerType === "serverFn",
});
 
export const startInstance = createStart(() => ({
  requestMiddleware: [csrfMiddleware],
}));