Next.js 16.4 Ships as a Critical Patch Lands Today

Today's audit is dominated by Next.js: Next.js 16.4 now recommends Cache Components for every app, an actively exploited Windows-only RCE is in the wild, and Vercel has scheduled an out-of-band security update for today, October 14. Everything below was checked against official sources; categories with nothing new from verifiable primary sources are noted at the end rather than padded.

Executive Summary

• Next.js out-of-band security update (Oct 14): fixes two Critical and one High vulnerabilities in upstream dependencies; full advisories ship with the release. Two fixes were postponed from September.
• CVE-2026-75604 (CVSS 9.0): path traversal via encoded backslashes exposes the Server Actions encryption key on Windows-hosted Next.js; exploitation observed, public Metasploit module.
• Next.js 16.4 (Oct 6): Cache Components recommended for all apps, new ensureStatic and navigation() APIs, React 19.3, and 20–25% smaller Turbopack disk cache.
• Docker Compose 5.6.0 (Oct 2): manually-triggered job support, provider-service improvements, and watch/up fixes.
• Node.js 26.11.1 (Oct 7) is the latest Current release; it is not listed as a security release.

Next.js: security first

CVE-2026-75604: Server Actions key exposure on Windows

A third-party analysis of CVE-2026-75604 reports that an encoded ..%5C in a route segment can escape the cache folder and expose server-reference-manifest.json, which holds the Server Actions encryption key. With it, an attacker can forge Server Action values and, via the public Metasploit module, reach remote code execution as the Node.js process. Affected: Next.js 13.4.0 up to 15.5.24 and 16.3.3 on Windows-hosted servers (Vercel states Linux and macOS are not affected). The write-up recommends 15.5.26 or 16.3.6, notes there is no patched 13.x or 14.x line, and reports exploitation as recently as September 24. Treat these details as secondary-source until you confirm them against the official Vercel advisory.

Recommended response: block backslash patterns at your WAF while patching, upgrade, delete the build cache so a fresh key is generated, then rotate the key:

npm install next@latest
rm -rf .next/cache/.rscinfo   # or remove .next entirely
next build
# If you pin the key, set a NEW value and redeploy every instance:
# NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=<new-base64-key>

Out-of-band update today

The Next.js team announced an update for three upstream-dependency vulnerabilities (two Critical, one High). Advisories, affected versions, and upgrade instructions publish with the release, so check the Next.js blog and your lockfile today and plan to upgrade immediately.

Next.js 16.4: what changed

The 16.4 release recommends Cache Components for every app (the default in Next.js 17), and new apps from create-next-app have it on. It also ships React 19.3. Enable the model with:

import type { NextConfig } from 'next';

const nextConfig: NextConfig = {
  cacheComponents: true,
  partialPrefetching: true,
};

export default nextConfig;

New ensureStatic fails the build if dynamic content sneaks into a route that should stay static:

export const ensureStatic = 'navigation'; // or 'prefetch' | 'shell'

export default async function RootLayout({ children }) {
  // ...
}

And await navigation() defers expensive cached work until a real navigation instead of a prefetch:

import { navigation } from 'next/cache';

async function Thread({ id }) {
  await navigation(); // excluded from prefetch
  const thread = await getThread(id);
  // ...
}

Other highlights: Turbopack's disk cache is 20–25% smaller (Zstandard), server HMR is lazy, production CSS Module class names and export names are shorter, and the new next upgrade --agent command plus experimental.agentUpgrade (default policy 'security') nudges you toward security-relevant upgrades. Experimental flags include turbopackGc, turbopackLazyDynamicImports and a Rust React Compiler.

Docker Compose 5.6.0

The 5.6.0 release adds partial job support (only manually-triggered jobs for now), new provider-service requests and a network relay, coalesces watch rebuilds during bursts of file changes, honors --parallel across bulk operations, and removes dangling images on down. The previous 5.5.0 release warned that containers may be recreated on first up after upgrading because of image-digest reconciliation changes.

Node.js

Node.js 26.11.1 landed Oct 7 alongside 26.11.0; the blog lists neither as a vulnerability release (see the vulnerability index). Note that Next.js currently falls back to child processes for Turbopack worker threads on Node.js 24.13.1 and newer because of an upstream Node.js bug.

Coverage note

This run verified Next.js, React, Node.js and Docker Compose from primary sources. The remaining tools on the audit list (Keycloak, Authentik, Cloudflare, Prisma, PostgreSQL, Redis and others) had no verified same-day release found in this pass, so they are intentionally omitted rather than speculated about.