Plate 66
Next.js 16.3.8 security release: SSRF, cache, and OG routes (and the earlier next/og RCE)
Next.js 16.3.8 (30 Sep 2026) covers image SSRF and cache bugs. CVE-2026-94545, the next/og RCE, was patched in 16.3.6 and is not a 16.3.8 fix.
Summary3 Oct 2026 · 7 min