Next.js 16.2.11 security update

Both starter kits now ship Next.js 16.2.11. This is the first release under the new scheduled Next.js security release program and contains fixes for four high-severity and five moderate advisories.

Security fixes

The patched release addresses denial-of-service, middleware or proxy bypass, server-side request forgery, cache confusion, image optimization, Server Function endpoint disclosure and unbounded Server Action payload issues.

Whether an individual advisory applies depends on the application's runtime, routing and deployment configuration. The safest path is to update rather than trying to exclude every affected configuration manually.

What changed in Achromatic

• Updated next from 16.2.10 to 16.2.11 in Pro Prisma and Pro Drizzle.
• Refreshed each npm lockfile so the matching Next.js runtime and compiler packages resolve to 16.2.11.
• Re-ran type checking, linting, unit tests and production builds for both kits.
• Refreshed the downloadable Achromatic Pro archive with the patched repositories.

Existing projects

Existing projects should update Next.js and regenerate their lockfile:

npm install next@16.2.11

Commit both package.json and package-lock.json, then run the same checks you use before a production deployment. No database migration is required for this patch.

Read the Next.js 16.2.11 release notes for the complete advisory list and the Achromatic security update guide for application-specific upgrade guidance.