Next.js 16.4.5 Security Release and Dev Stack Release Audit: November 5, 2026

Executive Summary

• Next.js 16.4.5 is a security-only release. It fixes seven moderate advisories, five of them tied to use cache / Cache Components, plus an SVG image-optimization bypass and HttpOnly cookie exposure on Edge routes. See the release notes.
• Better Auth 1.7.17 ships only bug fixes, several in auth edge cases: session revocation, OAuth state validation, trusted-origin matching and two-factor flows. See the release notes.
• Wrangler 4.157.0 makes wrangler delete offer to remove a Worker's Container applications, which previously kept running and billing. See the release notes.
• Astro 7.4.5 returns a 400 for invalid percent-encoded paths and hardens dynamic tag names. See the release notes.
• Tailwind CSS 4.3.4 adds @tailwindcss/turbopack for Next.js. See the release notes.
• BullMQ 6.7.0 adds counting delayed jobs before a timestamp. See the release notes.

I pulled versions and publish dates from the npm registry and read the release notes linked above. Tools in the "Also published" table have a new version on npm, but I did not review their notes, so I make no claims about their contents.

Next.js 16.4.5: seven moderate advisories

The release page lists no feature work, only security fixes. All seven are rated Moderate. If you use use cache or Cache Components, upgrade first.

Upgrade with your package manager:

npm install [email protected]

Until you can upgrade, check whether anything in your codebase passes tenant-specific data into a cached function. That is the pattern most of these advisories describe:

import { unstable_cache } from "next/cache";

// Review calls like this: tenant-scoped data behind a shared cache.
export const getInvoices = unstable_cache(
  async (tenantId: string) => db.invoice.findMany({ where: { tenantId } }),
  ["invoices"]
);

Better Auth 1.7.17

The release is bug fixes only and lists no CVEs or advisories. Several fixes touch security-relevant behavior, so read them if you run these features:

• Sessions created by a session.delete.after hook are no longer treated as revoked during "revoke all sessions" with secondaryStorage and storeSessionInDatabase.
• Denying a device authorization request now rejects a revoked session still in the cookie cache.
• IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets.
• @better-auth/expo social sign-in rejects authorization URLs without a state parameter when OAuth state is stored in a cookie.
• TOTP verification accepts API key sessions, and trusted devices are respected when the two-factor step runs from your own hook on another sign-in path such as email OTP.

Cloudflare Wrangler 4.157.0

Wrangler 4.157.0 has two changes worth knowing:

• Billing cleanup: wrangler delete now offers to delete the Worker's Container applications. With --force or in CI it lists them instead, and you remove them yourself.
• zstd layers: opt in to zstd compression for container image layers with an environment variable.

# Remove a leftover container application after deleting a Worker
wrangler containers delete <id>

# Opt in to zstd-compressed image layers
WRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd wrangler deploy

The default compatibility date also moves to 2026-11-03. Projects without a configured compatibility_date pick up the bundled workerd release's date, so pin it in your config if you want stable behavior.

{
  "name": "my-worker",
  "compatibility_date": "2026-11-03"
}

Astro 7.4.5

Astro 7.4.5 contains patch fixes only:

• Request paths with invalid percent-encoding, such as /%C0%AF or a bare %, now return a 400 instead of routing with the undecoded path (#18544).
• String tag names render consistently across .astro, JSX and MDX. Only the leading valid element name is rendered, and strings like '!--' now throw (#18520).
• import.meta.env values containing $ sequences are no longer corrupted during astro build (#18559).

Tailwind CSS 4.3.4

Tailwind CSS 4.3.4 adds @tailwindcss/turbopack, a Turbopack loader for Next.js. The rest is fixes: macOS standalone binaries now have a valid code signature so macOS 27 no longer kills them at launch, @tailwindcss/oxide falls back to WASM where native bindings are missing, and source detection respects negation-based .gitignore rules.

BullMQ 6.7.0

BullMQ 6.7.0 adds the ability to count delayed jobs before a timestamp (#5026). The release page lists no fixes.

Also published today (notes not reviewed)

These had new npm versions in the last few days. I checked the registry only.

What I'm doing

I'm upgrading Next.js first because five of the seven advisories involve cache sharing across users or tenants. After that I'll check the Better Auth session-revocation and trusted-origin changes against my config, then pin compatibility_date on any Worker that doesn't set it.

Sources

• Next.js v16.4.5 release
• Better Auth v1.7.17 release
• Wrangler 4.157.0 release
• Astro 7.4.5 release
• Tailwind CSS v4.3.4 release
• BullMQ v6.7.0 release
• npm registry for the version table