Next.js 16.4, Express 5.3 & NestJS 12.1: Release Audit

Executive Summary

• Security: Next.js will ship an out-of-band update on October 14, 2026 fixing two Critical and one High upstream vulnerabilities (announcement). Plan to upgrade the day it lands.
• Breaking: Next.js 16.4.0 makes strict route matching the default and removes legacy PPR code paths.
• Security: Express 5.3.0 bumps qs, proxy-addr and body-parser to address several CVEs; an invalid body-parser limit now throws at startup.
• Fixes: NestJS 12.1.3 improves shutdown and microservice reliability; Nuxt 4.6.1 ships dev-server and typing fixes.
• Also published in the last week (npm registry): Hono 4.13.13, Astro 7.3.8, SvelteKit 3.0.1, Svelte 5.57.2, BullMQ 6.3.13, Motion 14.1.0, MUI 9.5.0, Clerk Next.js SDK 7.9.14, Drizzle ORM 0.45.4 and Prisma 8.0.0-rc.22.

Next.js 16.4 and the October 14 Security Update

The 16.4.0 release notes list several default changes: ensureStatic is stabilized, navigation() and prefetch() drop their unstable_ prefix, create-next-app enables Cache Components by default, and Turbopack turns on export name mangling and the shared runtime for production builds. Strict route matching is now default, the experimental appNewScrollHandler option is gone, and the Pages Router deprecates React 18 support. AVIF image optimization is re-enabled. The release page lists PR titles only, so check each PR before relying on details.

Vercel says the October 14 update covers three upstream vulnerabilities (two Critical, one High), two of them postponed from the September release. Affected versions are not yet published; full advisories arrive with the release (source). Pin and test now so the upgrade is a one-line change:

Action: upgrade as soon as the patched version is announced.

npm install next@latest react@latest react-dom@latest
npx next build

Express 5.3.0: Dependency CVEs and Stricter Limits

Per the v5.3.0 release, qs moves to ^6.16.0, proxy-addr to ^2.0.8 and body-parser to ^2.3.0. Notably, an invalid limit option in body-parser now throws at startup instead of silently disabling the size limit. req.fresh now validates QUERY requests, and content-disposition no longer quotes valid token filenames, which can break tests asserting exact header bytes.

// A malformed limit used to disable the cap silently; now it throws on boot.
app.use(express.json({ limit: '100kb' }));

NestJS 12.1.3 and Nuxt 4.6.1

NestJS 12.1.3 runs the shutdown sequence after a failed init, fixes SSE, middleware and route matching issues, and patches Kafka, Redis, NATS, RabbitMQ, MQTT, gRPC and TCP transports. The Fastify adapter now honors return503OnClosing during shutdown, and both adapters gained limits on field nesting and array indexes in file uploads.

Nuxt 4.6.1 defers Nitro's portable event web view until first access, registers dev handlers once, fixes dependency scanning on virtual imports, and tightens types (setPageLayout accepts false; global $fetch uses TypedFetch).

Coverage Notes

Versions above for Hono, Astro, BullMQ and others were confirmed on the npm registry only; changelogs were not reviewed. GitHub API access was unavailable for this audit, so Docker, Kubernetes, Keycloak, PostgreSQL, Redis, Laravel, Django and FastAPI releases were not checked today.