Next.js v16.3.5 Released: Bug Fixes for next/image, Standalone Output, CSP Nonces, and Cache Signals

Next.js v16.3.5 Drops with Targeted Bug Fixes

The Next.js team has shipped v16.3.5 today, September 12, 2026, delivering a focused set of backported bug fixes that address key issues in image optimization, standalone output, CSP nonces, and cache prerender signals. While this is not a feature release, these fixes are important for production stability.

What’s Fixed in v16.3.5

The release backports the following bug fixes from canary:

  • next/image — Skip 0-byte entries when initializing disk LRU cache: Prevents errors caused by empty or corrupt cache entries during image optimization initialization.
  • next/image — Reject empty images when reading/writing to the disk cache: Adds a guard to ensure empty image files are not written to or read from the disk cache, improving reliability of the Image Optimization API.
  • Standalone output NFT fix: Emits whole-app server Next Function Traces (NFTs) when output: 'standalone' is used with an adapter, resolving a deployment issue for users on custom server adapters.
  • CSP nonce support for loading and template files: Adds Content Security Policy (CSP) nonce attributes to script tags in loading and template files, closing a gap for apps with strict CSP policies.
  • Fix use cache prerender signal retention: Resolves an issue where cache prerender signals were not being properly retained, which could cause inconsistent caching behavior in production.

Who Should Upgrade?

This release is part of the Active LTS (16.3.x) branch. If you are running any version of Next.js 16.3.x in production, upgrading to v16.3.5 is recommended — especially if your app:

  • Uses the Next.js Image Optimization API with AVIF or other formats
  • Deploys with output: 'standalone' and a custom adapter
  • Enforces a strict Content Security Policy
  • Relies on the use cache directive for prerendering

How to Upgrade

npm install next@16.3.5
# or
yarn add next@16.3.5
# or
pnpm add next@16.3.5

Context: Recent Next.js Releases

This patch follows a busy August for the Next.js team, which included the August 2026 Security Release (v16.3.3) that patched two critical RCE vulnerabilities, and v16.3.4 which re-enabled AVIF image optimization. The v16.3.5 release continues the team’s commitment to keeping the Active LTS branch stable and production-ready.

Key Takeaway: v16.3.5 is a stability-focused patch release. No breaking changes are included. Upgrade at your earliest convenience if you are on the 16.3.x branch.

Hashtags: #NextJS #WebDevelopment #JavaScript #React #Vercel #FrontendDev #WebPerformance #OpenSource

Resources:

Search

Categories

Archives