Sourced from next's releases.
v15.5.15
Please refer the following changelogs for more information about this security release:
https://vercel.com/changelog/summary-of-cve-2026-23869
v15.5.14
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
- Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)
Credits
Huge thanks to
@styfleand@lllomhfor helping!v15.5.13
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Credits
Huge thanks to
@ztannerfor helping!
412eb90
v15.5.15cb90de9
[15.x] Avoid consuming cyclic models multiple times (#74)fffef9e
Fix CI for glibc linux buildsd7b012d
v15.5.142b05251
[backport] feat(next/image): add lru disk cache and
`images.maximumDiskCacheS...f88cee9
Backport: Fix(pages-router): restore Content-Length and ETag for
/_next/data/...cfd5f53
v15.5.1315f2891
[backport]: fix: patch http-proxy to prevent request smuggling in
rewrites (#...d23f41c
v15.5.128e75765
fix unlock in publish-native