October security patches: Next 16.4.3 and Node 22.23.4
Two critical remote code execution bugs in one week, one in Next and one in Node. If you have a project in production, update even if you are not touching anything else.
October brought two critical bugs back to back in the boilerplate's stack, both remote code execution. This release adds nothing new: it just closes those two doors. If you have a production project built with CREA.MBA, this is the update you should not put off.
Next 16.4.3
On October 14 Next shipped patches for two remote code execution bugs: one in use cache and one in
SVG image processing through sharp. next, eslint-config-next and @next/third-parties move to
16.4.3, and are now pinned to that exact version instead of using ^: a security patch arrives
when you decide to update, not as a surprise in the next build.
Node 22.23.4 at deploy time
On October 21 Node2Shell (CVE-2026-111497) was published, a remote code execution bug in Node's Brotli decoder, with a public exploit the next day.
There is a trap here that you can't see in the repo: Coolify builds with nixpacks, and nixpacks
ships a year-old Node by default (22.19.0), whatever your package.json asks for. You only notice
it in the build log. The boilerplate now ships a nixpacks.toml at the root that pins a nixpkgs
with Node 22.23.4. To upgrade later, change the nixpkgsArchive commit, as the deploy guide
explains.
Upgrading from 2.x
- Bump
next,eslint-config-nextand@next/third-partiesto16.4.3, then runbun installandbun run buildlocally before deploying. - Copy the root
nixpacks.tomlinto your project if you deploy with Coolify or nixpacks. If you use your own Dockerfile, start from anode:22.23.4image or later. - After deploying, look for
nodejs-22.23.4in the build log to confirm it picked up the right Node.
No code changes needed: the cacheComponents migration that Next 16.4 requires has been in place
since 2.0.