cve-2026-94545

Next.js 16.3.8 security release: SSRF, cache, and OG routes (and the earlier next/og RCE)

Next.js 16.3.8 (30 Sep 2026) covers image SSRF and cache bugs. CVE-2026-94545, the next/og RCE, was patched in 16.3.6 and is not a 16.3.8 fix.