# Next.js 16: what's new?

> Next.js 16 is a major release that includes several new features and improvements. In this article, we will cover the new features and improvements in Next.js 16, plus what changed in 16.1 and 16.2.

*Published: 2025-10-22*
*Canonical: https://makerkit.dev/blog/tutorials/nextjs-16*

---

Next.js 16 shipped on October 21, 2025, and it's the largest performance-focused release since the App Router launched. Build times dropped by 50% or more with the now-stable Turbopack bundler, and the new caching model gives you explicit control over what gets cached.

**Next.js 16 is the October 2025 major release of the React framework.** It makes Turbopack the default bundler (2-5x faster builds), introduces Cache Components with `"use cache"` directives replacing PPR, and bundles React 19.2. The upgrade from Next.js 15 is straightforward because most breaking changes are handled by codemods.

**What you get in Next.js 16:**
- Turbopack is stable and enabled by default (2-5x faster builds, up to 10x faster Fast Refresh)
- Cache Components replace PPR with explicit `"use cache"` directives
- New caching APIs: `updateTag()`, `refresh()`, and an improved `revalidateTag()`
- `proxy.ts` replaces middleware for clearer network boundary control
- React 19.2 with `<Activity>`, `useEffectEvent`, and View Transitions
- React Compiler is now stable (still opt-in)
- DevTools MCP for AI-assisted debugging

Tested with Next.js 16.2 and React 19.2. Makerkit's [Next.js SaaS kits](/) ship with these defaults.

## What's New Since 16.0

The 16.x line has shipped two minor releases since launch. If you're upgrading today, you're getting all of these by default:

**Next.js 16.1** (December 2025):
- **Turbopack File System Caching is now stable** — persists compiler artifacts across dev server restarts
- Bundle Analyzer (experimental) for inspecting client and server bundles
- `next dev --inspect` for attaching a Node.js debugger to the dev server

**Next.js 16.2** (March 2026):
- ~400% faster `next dev` startup and ~50% faster rendering vs 16.0
- **Build Adapters API is now stable** — the foundation for OpenNext, AWS Amplify, Cloudflare, and other non-Vercel deployments to support the full Next.js 16 feature set, including `proxy.ts`
- Server Fast Refresh for fine-grained server-side hot reloading in Turbopack
- AI improvements: agent-ready `create-next-app`, browser log forwarding to the terminal, and a dev server lockfile that prevents two AI agents from racing on the same project

If you're already on 16.0, the 16.1 → 16.2 upgrade is non-breaking. Just bump the version.

## Security: Upgrade to 16.2.6 (May 2026)

Next.js **16.2.6** shipped on May 7, 2026 with a coordinated batch of **13 security advisories** patched in a single release. If you're on any 16.x version below 16.2.6, upgrade now.

**High severity (7):**
- DoS in Server Components ([GHSA-8h8q-6873-q5fj](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj))
- App Router `proxy.ts`/middleware bypass via segment-prefetch routes ([GHSA-267c-6grr-h53f](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) and follow-up [GHSA-26hh-7cqf-hhc6](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6))
- Connection-exhaustion DoS in Cache Components ([GHSA-mg66-mrh9-m8jx](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx))
- Dynamic route parameter injection bypass ([GHSA-492v-c6pp-mqqv](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv))
- SSRF in apps that handle WebSocket upgrades ([GHSA-c4j6-fc7j-m34r](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r))
- Pages Router i18n middleware bypass ([GHSA-36qx-fr4f-26g5](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5))

**Moderate (4):** XSS, Image Optimization API DoS, and cache poisoning in React Server Component responses.

**Low (2):** Cache-busting collisions and middleware redirect cache poisoning.

The release also backports six fixes: HTTP access fallback preservation during prerender recovery, fallback route parameter casing, route-level RSC request validation, direct route handler header patching, deployment ID inclusion in cache handler keys, and a URL pathname double-encoding fix in client parameter parsing.

```bash
npm install next@16.2.6
```

### Earlier Security Patches

If you're still on a much older 16.x version, the December 2025 advisories also apply:

- **[CVE-2025-66478](https://nextjs.org/blog/CVE-2025-66478)** (CVSS **10.0**, Critical): RCE in the React Server Components protocol. Patched in 16.0.4.
- **[CVE-2025-55184](https://nextjs.org/blog/security-update-2025-12-11)** (High): DoS via crafted RSC payloads.
- **[CVE-2025-55183](https://nextjs.org/blog/security-update-2025-12-11)** (Medium): Source code exposure in specific routing edge cases.

All three are bundled into 16.2.6, so a direct jump from 16.0.x straight to 16.2.6 covers everything.

## Should You Upgrade to Next.js 16?

**Upgrade now if:**
- You're starting a new project (Next.js 16 is the new default)
- Build times are a bottleneck for your team
- You want explicit control over caching with Cache Components
- You're already on Next.js 15 and have async dynamic APIs

**Wait if:**
- Your project uses AMP (all AMP APIs are removed)
- Third-party libraries you depend on aren't React 19.2 compatible yet
- You're on a hosting platform whose adapter hasn't shipped Next.js 16 support yet (most major providers shipped support during Q1 2026 — check your provider's release notes)

**If unsure:** Upgrade a staging environment first and run your test suite. Most projects migrate without issues.

## Turbopack Is Now Stable and Default

Turbopack, the Rust-based bundler that replaces Webpack, graduates from experimental to stable in Next.js 16. It's enabled by default for both development and production builds.

The performance gains are substantial. In our testing with the Makerkit SaaS Kit:

- **Development startup**: 603ms (down from 1083ms in Next.js 15)
- **Production builds**: 5.7 seconds with Turbopack vs 24.5 seconds with Webpack
- **Fast Refresh**: Under 100ms for most changes

The Makerkit SaaS Kit now starts in 603ms with Next.js 16, nearly half the time of Next.js 15.

### Filesystem Caching (Stable in 16.1)

Turbopack supports filesystem caching, which persists compilation results across dev server restarts. This makes subsequent startups significantly faster. The feature shipped as beta in 16.0 and graduated to **stable in Next.js 16.1**.

Enable it in your `next.config.ts`:

```ts {% title="next.config.ts" %}
const nextConfig = {
  experimental: {
    turbopackFileSystemCacheForDev: true,
    turbopackFileSystemCacheForBuild: true,
  },
};

export default nextConfig;
```

If you hit a stale cache after upgrading dependencies or changing config, clear `.next` and restart the dev server.

### Benchmarks: Next.js 16 vs Next.js 15

We benchmarked Next.js 16 against Next.js 15 using the Makerkit SaaS Kit on a MacBook Pro M3 Max with 36GB RAM.

#### Startup Time

{% chart
   type="bar"
   data=[
     { "name": "Instrumentation Node.js", "nextjs15": 47, "nextjs16": 25 },
     { "name": "Instrumentation Edge", "nextjs15": 38, "nextjs16": 4 },
     { "name": "Middleware", "nextjs15": 124, "nextjs16": 26 },
     { "name": "Total Ready Time", "nextjs15": 1083, "nextjs16": 603 }
   ]
   config={
     "nextjs15": {
       "label": "Next.js 15 (ms) (lower is better)",
       "color": "var(--chart-1)"
     },
     "nextjs16": {
       "label": "Next.js 16 (ms) (lower is better)",
       "color": "var(--chart-2)"
     }
   }
   showLegend=true
   height=350
/%}

Every metric improved. Edge instrumentation dropped from 38ms to 4ms. Total ready time dropped 44%.

#### Navigation Performance

{% chart
   type="bar"
   data=[
     { "name": "Initial Load (/)", "nextjs15": 2930, "nextjs16": 1775 },
     { "name": "/blog", "nextjs15": 501, "nextjs16": 214 },
     { "name": "/docs", "nextjs15": 412, "nextjs16": 419 },
     { "name": "/home/[account]", "nextjs15": 778, "nextjs16": 911 },
     { "name": "/home/billing", "nextjs15": 549, "nextjs16": 406 }
   ]
   config={
     "nextjs15": {
       "label": "Next.js 15 (ms) (lower is better)",
       "color": "var(--chart-1)"
     },
     "nextjs16": {
       "label": "Next.js 16 (ms) (lower is better)",
       "color": "var(--chart-2)"
     }
   }
   showLegend=true
   height=350
/%}

Most routes are faster. The dynamic `/home/[account]` route shows a slight regression, which we're investigating. Initial page load dropped from 2.9s to 1.8s.

#### Production Build Times

{% chart
   type="bar"
   data=[
     { "name": "Production Build (lower is better)", "webpack15": 27.865, "turbopack15": 8.487, "webpack16": 24.563, "turbopack16": 5.669 }
   ]
   config={
     "webpack15": {
       "label": "Next.js 15 Webpack",
       "color": "var(--chart-1)"
     },
      "webpack16": {
       "label": "Next.js 16 Webpack",
       "color": "var(--chart-5)"
     },
     "turbopack15": {
       "label": "Next.js 15 Turbopack",
       "color": "var(--chart-3)"
     },
     "turbopack16": {
       "label": "Next.js 16 Turbopack",
       "color": "var(--chart-2)"
     },
   }
   showLegend=true
   height=350
/%}

Turbopack in Next.js 16 builds the Makerkit SaaS Kit in **5.7 seconds**, which is 4.3x faster than Webpack on Next.js 16 and 4.9x faster than Webpack on Next.js 15.

Not quite Vite-level instant, but the gap is closing. For a real SaaS codebase with auth, billing, and database integrations, these numbers are solid.

## Cache Components Replace PPR

The experimental `ppr` flag and `dynamicIO` are gone. Cache Components are the new model, and they're more explicit about what gets cached.

Instead of configuring PPR globally, you mark individual components or functions with `"use cache"`:

```tsx {% title="app/posts/page.tsx" %}
import { Suspense } from 'react';

async function BlogPosts() {
  'use cache';

  const posts = await db.posts.findMany();
  return <PostList posts={posts} />;
}

export default function PostsPage() {
  return (
    <Suspense fallback={<PostsSkeleton />}>
      <BlogPosts />
    </Suspense>
  );
}
```

The compiler generates cache keys automatically. Dynamic code runs at request time by default. Only `"use cache"` blocks get cached.

Enable Cache Components in your config:

```ts {% title="next.config.ts" %}
const nextConfig = {
  cacheComponents: true,
};

export default nextConfig;
```

This approach is cleaner than PPR's incremental opt-in. You see exactly what's cached by looking at the code.

## New Caching APIs

Next.js 16 introduces three caching functions that give you precise control over cache invalidation.

### updateTag(): Immediate Cache Refresh

`updateTag()` expires a cache tag and immediately refreshes the data within the same request. This provides read-your-writes semantics: the user sees their change immediately, not stale data.

```tsx {% title="app/actions/profile.ts" %}
'use server';

import { updateTag } from 'next/cache';
import { db } from '@/lib/db';

export async function updateUserProfile(userId: string, data: ProfileData) {
  await db.users.update(userId, data);
  updateTag(`user-${userId}`);
}
```

Use `updateTag()` when the user needs to see their change immediately, like updating a profile or posting a comment.

**Constraint**: `updateTag()` only works in Server Actions. It can't be called from Route Handlers or anywhere else. Use `revalidateTag()` in those contexts.

### revalidateTag(): Stale-While-Revalidate

`revalidateTag()` now requires a cache profile as the second argument. This enables stale-while-revalidate behavior: users see cached content immediately while Next.js refreshes in the background.

```tsx {% title="app/actions/posts.ts" %}
'use server';

import { revalidateTag } from 'next/cache';

export async function publishPost(postId: string) {
  await db.posts.publish(postId);

  // Use built-in profiles
  revalidateTag('blog-posts', 'max');

  // Or specify inline
  revalidateTag('homepage', { expire: 3600 });
}
```

Built-in profiles: `'max'`, `'hours'`, `'days'`. Use `revalidateTag()` for content where brief staleness is acceptable, like blog posts or product listings.

### refresh(): Update Uncached Data

`refresh()` updates uncached data without touching the cache at all. Use it for real-time indicators that shouldn't be cached.

```tsx {% title="app/actions/notifications.ts" %}
'use server';

import { refresh } from 'next/cache';

export async function markNotificationRead(id: string) {
  await db.notifications.markRead(id);
  refresh();
}
```

This refreshes notification counts, unread indicators, or live metrics without invalidating your cached page shell.

### When to Use Each

| Function | Use Case | Behavior |
|----------|----------|----------|
| `updateTag()` | User edits their data | Blocks until fresh data arrives |
| `revalidateTag()` | Content updates | Shows stale data, refreshes in background |
| `refresh()` | Real-time indicators | Updates uncached data only |

## proxy.ts Replaces middleware.ts

The middleware filename is deprecated. Rename it to `proxy.ts` to clarify that it handles network boundary concerns like rewrites, redirects, and request modification.

**Before (Next.js 15):**

```ts {% title="middleware.ts" %}
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  if (!request.cookies.get('session')) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}
```

**After (Next.js 16):**

```ts {% title="proxy.ts" %}
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function proxy(request: NextRequest) {
  if (!request.cookies.get('session')) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: ['/dashboard/:path*', '/settings/:path*'],
};
```

Key changes:
- Rename `middleware.ts` to `proxy.ts`
- Rename the exported function from `middleware` to `proxy` (or use default export)
- **No more response bodies**: Proxy can only rewrite, redirect, or modify headers. Return full responses from Route Handlers instead.

The `middleware.ts` file still works but is deprecated and will be removed in a future version. Run the codemod to migrate automatically:

```bash
npx @next/codemod@canary upgrade latest
```

The codemod will output: `Migrated middleware.ts to proxy.ts` and list the updated files.

**If you use OpenNext or another non-Vercel adapter**: As of Next.js 16.2 (March 2026), Vercel collaborated with the OpenNext team on a stable [Build Adapters API](https://nextjs.org/blog/nextjs-across-platforms) so non-Vercel platforms can support `proxy.ts` and the rest of the Next.js 16 feature set. Check your provider's release notes for the version where 16.x support landed before migrating.

## React 19.2

Next.js 16 bundles React 19.2 with several new features.

### Activity Component

`<Activity>` controls component visibility while preserving state. Unlike conditional rendering, hidden components keep their state intact.

```tsx
import { Activity } from 'react';

function TabPanel({ activeTab }: { activeTab: string }) {
  return (
    <>
      <Activity mode={activeTab === 'home' ? 'visible' : 'hidden'}>
        <HomePage />
      </Activity>
      <Activity mode={activeTab === 'settings' ? 'visible' : 'hidden'}>
        <SettingsPage />
      </Activity>
    </>
  );
}
```

Use `<Activity>` when you want to pre-render content the user will likely visit, or preserve form state when switching tabs.

### useEffectEvent Hook

`useEffectEvent` creates stable callbacks that always access the latest props and state without adding them to the dependency array.

```tsx
import { useEffect, useEffectEvent } from 'react';

function ChatRoom({ roomId, onMessage }) {
  const onMessageEvent = useEffectEvent((message) => {
    onMessage(roomId, message);
  });

  useEffect(() => {
    const connection = connect(roomId);
    connection.on('message', onMessageEvent);
    return () => connection.disconnect();
  }, [roomId]); // onMessage not needed in deps
}
```

This reduces unnecessary effect re-runs and makes dependency arrays honest.

### View Transitions

React 19.2 supports the View Transitions API for animating navigation changes. Combined with Next.js's routing, you get smooth page transitions with minimal code.

For a detailed breakdown of React 19.2 changes including the new ESLint rules, see our [React 19.2 upgrade guide](/blog/tutorials/react-19-2).

## React Compiler Is Stable

The React Compiler is now stable and moved outside the experimental phase. It automatically memoizes components and hooks, reducing unnecessary re-renders.

```ts {% title="next.config.ts" %}
const nextConfig = {
  reactCompiler: true,
};

export default nextConfig;
```

Makerkit is fully compatible with the React Compiler. However, we keep it disabled by default because:

1. **Most Makerkit pages are server-rendered**, so memoization provides limited benefit
2. **It can introduce performance regressions** in some cases
3. **Third-party libraries may not be compatible**

Enable it if your app has complex, client-heavy components that re-render frequently. Profile before and after to verify improvements.

## Improved Navigation and Prefetching

Next.js 16 rewrote the prefetch cache with two significant optimizations.

### Layout Deduplication

Shared layouts are now downloaded once and reused across prefetched links. If ten links share a layout, you download it once instead of ten times.

In our testing, this reduced prefetch data transfer by 60-80% on pages with many navigation links.

### Incremental Prefetching

Next.js now only prefetches the parts of a route that aren't already cached. If you have the layout cached, it only fetches the page content.

Combined with automatic prefetch cancellation when links leave the viewport, navigation feels significantly smoother.

## DevTools MCP for AI-Assisted Debugging

Next.js 16 introduces a Model Context Protocol (MCP) integration that helps AI coding assistants understand your application.

The DevTools MCP provides:
- Next.js routing, caching, and rendering knowledge
- Unified browser and server logs
- Automatic error access with stack traces
- Page and route awareness

If you use Claude Code, Cursor, or other AI coding tools, the MCP gives them context about your Next.js app structure, making debugging suggestions more accurate.

## Common Pitfalls and How to Fix Them

### Stale Turbopack filesystem cache

**Symptom**: Strange behavior after updating dependencies or changing config.

**Fix**: Clear the `.next` directory:
```bash
rm -rf .next && npm run dev
```

### updateTag() not working in Route Handlers

**Symptom**: Cache isn't invalidating when you call `updateTag()` from a Route Handler.

**Fix**: `updateTag()` only works in [Server Actions](/blog/tutorials/nextjs-server-actions). Use `revalidateTag()` in Route Handlers instead.

### revalidateTag() missing profile argument

**Symptom**: TypeScript error or runtime error when calling `revalidateTag()`.

**Fix**: Add the required cache profile as the second argument:
```tsx
// Before (Next.js 15)
revalidateTag('posts');

// After (Next.js 16)
revalidateTag('posts', 'max');
```

### proxy.ts not supported by your hosting provider

**Symptom**: Deployment fails or middleware doesn't run.

**Fix**: Confirm your hosting provider has shipped a Next.js 16-compatible adapter. The stable Build Adapters API in 16.2 unblocked OpenNext, AWS Amplify, Cloudflare, and others — most landed support during Q1 2026. If your provider's adapter is still behind, keep using `middleware.ts` (deprecated but functional) until it catches up.

### Dynamic route regressions

**Symptom**: Some dynamic routes are slower than in Next.js 15.

**Fix**: Profile the specific route. Check if you're using uncached data fetching where caching would help. We observed this with `/home/[account]` and are investigating.

### React Compiler breaks third-party libraries

**Symptom**: Runtime errors or unexpected behavior after enabling React Compiler.

**Fix**: Disable React Compiler and identify the problematic library. You can exclude specific files from compilation or wait for library updates.

## Breaking Changes to Watch For

### Minimum Version Requirements

- **Node.js 20.9+** (Node 18 is no longer supported)
- **TypeScript 5.1+**
- Modern browsers: Chrome 111+, Edge 111+, Firefox 111+, Safari 16.4+

### Removed Features

- **AMP support**: All AMP APIs are removed
- **`next lint`**: Use Biome or ESLint directly
- **Sync dynamic APIs**: `cookies()`, `headers()`, `params`, and `searchParams` must be awaited

### Behavior Changes

- Turbopack is the default bundler
- Image optimization cache TTL increased from 60s to 4 hours
- All parallel route slots require explicit `default.js` files

Run the codemod to handle most migrations automatically. See the [official upgrade guide](https://nextjs.org/docs/app/guides/upgrading/version-16) for detailed instructions:

```bash
npx @next/codemod@canary upgrade latest
```

## Migration Checklist

### Update dependencies

Update the dependencies to the latest version:

```bash
npm install next@latest react@latest react-dom@latest
```
  
### Rename middleware to proxy

Rename the middleware file to `proxy.ts`:

```bash
mv middleware.ts proxy.ts
```

Update the export from `middleware` to `proxy`:

```ts
export function proxy(request: NextRequest) {
```

### Update async dynamic APIs
   ```tsx
   const cookieStore = await cookies();
   const headerStore = await headers();
   const { id } = await params;
   ```

### Check third-party compatibility

You should check if the third-party libraries you are using are compatible with Next.js 16:

- OpenNext doesn't support `proxy.ts` yet
- Some libraries may not work with React Compiler

### Update revalidateTag calls

Add the required profile argument: `revalidateTag('tag', 'max')`

### Test caching behavior

Cache Components work differently than PPR. Verify your caching strategy with the new `"use cache"` directive.

### Profile performance

Run benchmarks before and after. Check for navigation regressions on dynamic routes.

## Conclusion

Next.js 16 delivers the performance improvements the community has been waiting for. Turbopack is stable and fast enough for production use, Cache Components provide explicit caching control, and the new caching APIs give you precise invalidation options.

The migration from Next.js 15 is straightforward. Most changes are handled by codemods, and the breaking changes are well-documented.

Our [Next.js SaaS Starter Kit](/) ships with Next.js 16 by default. If you're building a new SaaS, you get these performance improvements out of the box. Still deciding on a framework? See how the App Router stacks up in [TanStack Start vs Next.js](/blog/tutorials/tanstack-start-vs-nextjs).

{% faq
   title="Frequently Asked Questions"
   items=[
     {"question": "Is Turbopack stable enough for production?", "answer": "Yes. Turbopack graduated from experimental to stable in Next.js 16 and is now the default bundler. Over 50% of Next.js 15.3+ projects were already using it before the stable release. We've been running it in production across multiple MakerKit customers without issues."},
     {"question": "What happened to PPR (Partial Pre-Rendering)?", "answer": "PPR evolved into Cache Components. Instead of a global ppr flag, you now use the 'use cache' directive to mark specific components or functions for caching."},
     {"question": "Do I need to migrate from middleware.ts immediately?", "answer": "No. middleware.ts still works in Next.js 16 but is deprecated. You should plan to migrate to proxy.ts before it's removed in a future version. The migration is simple: rename the file and change the export name."},
     {"question": "Should I enable the React Compiler?", "answer": "It depends. Enable it if your app has complex client components that re-render frequently. For server-heavy apps like most MakerKit projects, the benefits are minimal. Always profile before and after to verify improvements."},
     {"question": "What's the difference between updateTag and revalidateTag?", "answer": "updateTag blocks until fresh data arrives, giving users immediate feedback. revalidateTag shows stale data while refreshing in the background. Use updateTag for user edits, revalidateTag for content that can tolerate brief staleness."},
     {"question": "Is Next.js 16 compatible with OpenNext?", "answer": "Yes. The stable Build Adapters API in Next.js 16.2 (March 2026) was a direct collaboration with the OpenNext team and unblocked full Next.js 16 support — including proxy.ts — across non-Vercel platforms like AWS, Cloudflare, and self-hosted setups. Check your specific OpenNext adapter version for 16.x support, but the architectural blocker is gone."},
     {"question": "What changed in Next.js 16.1 and 16.2?", "answer": "16.1 (December 2025) made Turbopack File System Caching stable, added an experimental Bundle Analyzer, and shipped next dev --inspect for debugging. 16.2 (March 2026) made the Build Adapters API stable, brought a ~400% faster next dev startup, and added AI-focused improvements like browser log forwarding and a dev server lockfile. Both are non-breaking upgrades from 16.0."},
     {"question": "Are there any Next.js 16 security advisories I should know about?", "answer": "Yes. The most recent patch is Next.js 16.2.6 (May 7, 2026), which bundles 13 advisories: 7 high severity (including DoS in Server Components, proxy/middleware bypass via segment-prefetch routes, dynamic route parameter injection, SSRF in WebSocket upgrades, and a Pages Router i18n middleware bypass), 4 moderate (XSS, Image Optimization API DoS, RSC cache poisoning), and 2 low. Earlier, CVE-2025-66478 (CVSS 10.0, RCE in React Server Components) was patched in 16.0.4 in December 2025, alongside CVE-2025-55184 (DoS) and CVE-2025-55183 (source code exposure). Upgrade straight to 16.2.6 to cover everything."}
   ]
/%}

## Resources

- [Next.js 16 Drizzle SaaS Starter Kit](/nextjs-drizzle-saas-starter-kit) - Our production-ready Next.js SaaS Starter Kit with Drizzle ORM
- [Next.js 16 Prisma SaaS Starter Kit](/nextjs-prisma-saas-starter-kit) - Our production-ready Next.js SaaS Starter Kit with Prisma ORM
- [Next.js 16 Release Announcement](https://nextjs.org/blog/next-16) - Official blog post with full changelog
- [Next.js 16 Upgrade Guide](https://nextjs.org/docs/app/guides/upgrading/version-16) - Step-by-step migration instructions
- [React 19.2 Upgrade Guide](/blog/tutorials/react-19-2) - Detailed breakdown of React 19.2 changes
- [Server Actions Guide](/blog/tutorials/nextjs-server-actions) - Complete guide to Server Actions patterns
- [Secure Server Actions](/blog/tutorials/secure-nextjs-server-actions) - Security best practices for Server Actions