Next.js 16 ImageResponse RCE: Patch to 16.3.6 Now
Next.js 16.2.0 through 16.3.5 can expose Node.js ImageResponse routes to remote code execution. Check your runtime and inputs, patch to 16.3.6, then rebuild and redeploy.
By Yatish Goel
Journal / Category / 16 posts
Next.js
Guides, bug fixes, and best practices for building production apps with Next.js.
Next.js 15 EOL Is Oct 21, 2026: Upgrade Checklist for AI-Built Apps
Next.js 15 loses all support on October 21, 2026. Here is what changes in Next.js 16, what breaks in Cursor, v0 and Claude-generated apps, and the order to do the upgrade in.
By Yatish Goel
R2 Presigned PUT 403: Hidden Header Traps (2026)
Fix Cloudflare R2 presigned PUT 403s caused by header mismatches (Content-Type, checksums, CORS). A dev checklist you can use today.
By Akshit Ahuja
Vercel Cron Jobs Not Running? 6 Silent Fails (2026)
Vercel Cron Jobs can fail with zero logs. Here are 6 real causes in 2026, plus fixes for redirects, caching, secrets, and WAF.
By Yatish Goel
05Next.js
Next.js Middleware Ate My POST Body (2026 Fix)
Fix empty POST bodies in Next.js when middleware runs on Netlify/Vercel: root causes, real fixes, and what to ship in 2026.
By Yatish Goel
Fix Inngest 401s on Vercel (2026)
Inngest hitting 401/403 on Vercel? Deployment Protection is usually the cause. Here’s the bypass fix, plus safer options.
By Akshit Ahuja
Next.js PPR Auth Gotchas: Static Bail Out (2026)
Next.js PPR can break builds when auth reads headers/cookies in the wrong place. Here’s the fix playbook we use in 2026.
By Yatish Goel
Bubble to Next.js Cutover Plan (2026)
A practical cutover plan for migrating a Bubble app to Next.js in 2026, with real timelines, costs, and the stuff that breaks.
By Mahima Arora
NextAuth + Turnstile Redirect Loops (2026 Fix)
Fix the NextAuth + Cloudflare Turnstile redirect loop in Next.js App Router with middleware order, cookies, and callback URLs (2026).
By Yatish Goel
Vercel Cron Runs Twice on Deploy (2026 Fix)
Stop Vercel Cron endpoints firing on deploy or twice per schedule. A 2026 playbook for idempotency, headers, and safe guards.
By Yatish Goel
11Next.js
revalidatePath in setTimeout Bug (2026)
In Next.js App Router, revalidatePath/revalidateTag can silently no-op inside setTimeout. Here’s how to spot it and ship safe fixes in 2026.
By Yatish Goel
Server Actions: Stop Double Charges (2026)
Fix double-submit Server Actions with idempotency keys, Redis rate limits, and retry-safe patterns (Next.js in 2026).
By Yatish Goel
Next.js Proxy Auth Loops with Clerk (2026)
Next.js renamed middleware to proxy. Here’s how that can break Clerk auth and how to stop 307 sign-in loops fast in 2026.
By Yatish Goel
Next.js + Stripe Webhook Double-Credit Bug (2026)
Fix the common Next.js + Stripe double-credit bug: two writers, retries, and races. Patterns, costs, and a clean idempotent design (2026).
By Akshit Ahuja
Next.js Proxy Redirect Loops Behind a Load Balancer (2026)
Fix Next.js Proxy redirect loops behind load balancers: forwarded headers, matchers, trailing slash wars, and the localhost redirect bug (2026).
By Yatish Goel
Vercel Function Timeouts for AI in 2026
Shipping AI on Next.js + Vercel? Why routes hit 10s/60s limits in prod, plus fixes that actually work in 2026.
By Yatish Goel