Last week we announced that Next.js would be moving to a preannounced security release model, with patches announced ahead of time so that teams can plan for them.
Updates are now available in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.
These fixes are also available in the latest Next.js 16.3 canary ( v16.3.0-canary.92 ) and preview ( v16.3.0-preview.7 ) releases, and will be included in v16.3.0 once it reaches a stable release.
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage.
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog