Next.js 16.4: Cache Components by default, patch now

Next.js 16.4, released on October 6, 2026, makes Cache Components the recommended model for every Next.js app and turns it on by default for new projects ^[1]. Eight days later, the team shipped patched versions 16.4.1 and 15.5.28 to fix two critical remote code execution flaws ^[2]. If you run a Next.js site, the short version is: patch this week, then plan your move to Cache Components.

This article covers what changed in Next.js 16.4, what the October 14 security update fixes, and why the end of support for Next.js 15 on October 21 matters for older client sites.

Cache Components become the default

Cache Components is the name for the programming model Next.js has built across the 16.x releases. Developers mark parts of a page as cacheable with a 'use cache' annotation, which the team compares to a component-level version of the Cache-Control header ^[1]. Cached parts can be served instantly, while personalised parts render at request time in the same response ^[1].

Until now the team did not recommend it everywhere. With 16.4 that changes. In the team’s words, Cache Components is now “the best choice for every Next.js app,” new apps from create-next-app enable it by default, and it will become the default in Next.js 17 ^[1].

Two additions make the model easier to control:

• ensureStatic lets a page or layout guarantee that its shell, its prefetch or the whole navigation is static. If someone adds a dynamic component, the build fails ^[1].
• New navigation() and prefetch() functions let developers keep expensive content out of a prefetch until the user actually navigates ^[1].

The team names ecommerce stores, marketing pages and blogs as the kind of sites that benefit from ensureStatic ^[1]. That is most of what a studio like ours ships.

Agents get an upgrade path

Next.js 16.4 also leans into AI coding agents. A new next upgrade --agent command prepares migration guides, codemods and verification steps so an agent can upgrade an app from start to finish ^[1]. An experimental agentUpgrade setting nudges you or your agent during next dev or next build when a relevant upgrade is available, and its default policy only flags upgrades that fix known vulnerabilities ^[1].

There are smaller wins for every app too. Turbopack’s disk cache uses 20 to 25% less space, server hot reloads only compile what a request needs, CSS Module class names are shorter in production, and the release ships with React 19.3 ^[1].

The October 14 security update

On October 14, Next.js published an out-of-band security update ^[2]. It addresses three issues:

• Critical: unauthenticated remote code execution in apps using App Router with Cache Components, when a 'use cache' function returns multiple typed arrays. There is no workaround, and the team says to upgrade immediately even if your app has no such function ^[2].
• Critical: remote code execution in the Image Optimization API when handling SVG on glibc-based Linux, caused by an upstream library. The workaround is to use sharp 0.35.5 or later ^[2].
• High: denial of service in App Router apps with at least one Server Action, through crafted requests that tie up the CPU ^[2].

The fixes are in v16.4.1 for the Active LTS line and v15.5.28 for the Maintenance LTS line ^[2]. Two of the fixes had been postponed from the September security release because of upstream dependency delays ^[2].

Next.js 15 reaches end of support on October 21

Next.js keeps each major version in Maintenance LTS for two years after its release ^[3]. Version 15 was released on October 21, 2024, so its support ends on October 21, 2026 ^[3]. After that date, sites on 15.x stop receiving security fixes.

Many marketing sites and small web apps built in late 2024 and 2025 still run on 15.x. For those, 15.5.28 is likely one of the last patches they will get ^{[2, 3]}. The safer path is to move them to 16.4.1, and the new agent upgrade tooling can do part of that work, with a developer reviewing the result ^[1].

Key takeaways

• Next.js 16.4 (October 6) recommends Cache Components for every app and enables it by default for new apps ^[1].
• ensureStatic and navigation() give teams firm control over static pages and prefetching ^[1].
• The October 14 update fixes two critical remote code execution issues and one denial-of-service issue ^[2].
• Patched versions are 16.4.1 and 15.5.28 ^[2].
• Next.js 15 support ends on October 21, 2026 ^[3].

Quick answers about Next.js 16.4

Our site uses the Pages Router. Are we affected? The denial-of-service issue does not affect Pages Router apps or apps without Server Actions, but the image optimization issue is described in terms of the Image Optimization API on glibc-based Linux, not a router, so upgrade anyway ^[2].

Do we have to adopt Cache Components now? No. It is the default for new apps and will be the default in Next.js 17, so plan the migration rather than rushing it ^[1].

Can an AI agent do the upgrade? It can do much of it with next upgrade --agent, but a developer should review the changes and test key flows before release ^[1].