Next.js 16.3.6 fixes a critical RCE: upgrade now. Plus React 19.3, Bun 1.4 in Rust, Claude Opus 5.5, GPT-6 and Chrome 153, from the official notes.
· 5 min read
September 2026 brought one release you should act on today and four worth knowing. The Next.js security update (16.3.6) fixes a critical remote code execution bug in next/og: if you're on 16.2.0 to 16.3.5, upgrade now. React 19.3 makes <ViewTransition> stable, Bun 1.4 is rewritten in Rust, Claude Opus 5.5 and GPT-6 make capable AI models cheaper, and Chrome 153 adds <camera> and <microphone> elements.
Every fact below comes from the official release page, linked in each section. I build client sites and platforms on Next.js and React, so I read these notes anyway; this is the short version, with what I'd actually do.
On 22 September the Next.js team shipped an out-of-band security update. The issue is in the Node.js ImageResponse implementation of next/og, the API many sites use to draw their share images. Under specific conditions, improper escaping in the SVG that Satori generates could lead to remote code execution. It's rated critical.
Versions from 16.2.0 up to 16.3.5 that use the Node.js ImageResponse from next/og. The Edge ImageResponse and Next.js 15.x are not affected by the remote code execution; 15.5.26 adds related hardening.
Run npm install next@16.3.6 (or next@15.5.26 on 15.5), rebuild and redeploy. Check that your share images still render. Plan another upgrade for 16.3.7, announced for 30 September.
It passes 1,517 more tests from the Node.js test suite than before, the biggest compatibility jump since 1.0. Try it on tooling and tests first, and move a production server once your own dependencies pass on it.
Anthropic says it costs 40% less to run than Opus 5 on typical workloads. The token price is 20% lower: $4 per million input tokens and $20 per million output tokens.
Written by
Full Stack Developer & Web Marketer · Marrakech, Morocco
I build modern, scalable web applications end to end, from frontend to backend, with a focus on performance, clean code and user experience.
>=16.2.0 <16.3.6.ImageResponse, and Next.js 15.x (15.5.26 still ships related hardening).npm install next@16.3.6 # for 16.3
npm install next@15.5.26 # for 15.5 (hardening only)
It's the second Next.js security update in a month. On 25 August, 16.3.3 fixed two other critical bugs: an AVIF image optimisation RCE (AVIF optimisation is disabled until the upstream fix lands) and a Windows-only RCE (CVE-2026-75604). And the team has announced 16.3.7 for 30 September, with fixes for nine more vulnerabilities, one of them critical. Plan an upgrade window that week too.
This site runs on Next.js 16.3.6 already. If your site or platform uses Next.js and you're not sure which version it's on, npm ls next in the project tells you in a second.
React 19.3 (9 September) moves two APIs out of experimental. <ViewTransition> animates elements as they enter, exit, move or resize, using the browser's View Transition API. For a lot of page and list animations you no longer need an animation library.
import { ViewTransition } from 'react';
{isShowing && (
<ViewTransition>
<Component />
</ViewTransition>
)}Fragment refs are stable too, and react-dom gets a new browser() helper. A component that calls use(browser()) opts out of server-side rendering: on the server it suspends and the nearest Suspense fallback goes into the HTML; once hydrated in the browser it renders normally. Handy for anything only the browser knows, like the visitor's time zone.
import { use } from 'react';
import { browser } from 'react-dom';
function Component() {
use(browser());
// ...
}Also in 19.3: Trusted Types support (React passes trusted values through so your policies work), and Server Components can render a Context imported from a 'use client' module directly, without a wrapper component.
Bun 1.4 came out on 20 August. The headline is under the hood: Bun is rewritten from Zig to Rust. The numbers from the release post:
Bun.Image, Bun.WebView, Bun.markdown, Bun.cron() (registers a job with crontab, launchd or Task Scheduler) and Bun.Terminal.await Bun.file("photo.jpg")
.image()
.resize(1024, 1024, { fit: "inside" })
.rotate(90)
.webp({ quality: 85 })
.write("thumb.webp");Upgrade with bun upgrade. My take: try it on scripts, tooling and tests first; move a production server once your own dependencies pass on it.
Two releases on the same day, 22 September, both about getting strong models for less. Claude Opus 5.5 performs at the level of Claude Fable 5.1 on most work. Anthropic's tests show it costs 40% less to run than Opus 5 on typical workloads, and it generates output more than 30% faster. The token price itself is 20% lower: $4 per million input tokens and $20 per million output tokens. The model ID is claude-opus-5-5.
OpenAI released GPT-6 Sol and GPT-6 Luna, two reasoning models in the Responses and Chat Completions APIs. Sol is built for complex coding and agentic workflows; Luna is OpenAI's most efficient model for focused, high-volume tasks.
| Model | Input / 1M tokens | Output / 1M tokens | Made for |
|---|---|---|---|
| Claude Opus 5.5 | $4 | $20 | Fable 5.1-level work, cheaper and faster than Opus 5 |
| Claude Fable 5.1 | $10 | $50 | The most capable Claude (released 1 September) |
| GPT-6 Sol | $2 | $10 | Complex coding and agentic workflows |
| GPT-6 Luna | $0.10 | $0.50 | Focused, high-volume tasks |
For the features I build into client platforms (an AI tutor, support answers, summaries), a price drop like this matters more than benchmark points: the same feature costs less every month. Prices are from Anthropic's and OpenAI's model pages.
Chrome 153 reached stable on 8 September. The feature I'll use first: <camera> and <microphone>, declarative HTML controls that ask for one capability each. The browser draws the control, and nothing is requested until the user clicks it. For live classes and video calls, that's a cleaner permission flow than calling getUserMedia() from your own button.
scroll-axis-lock: a CSS property to stop the browser locking a scroll gesture to one axis (useful for maps and big tables).Iterator.zip() and Iterator.zipKeyed(), and a method to join an iterator into a string.And the bigger change: from Chrome 153, a new stable version ships every two weeks. Features reach users faster, and it's one more reason to test on the current Chrome before each release of your own.
npm ls next on every project and upgrade to 16.3.6. Put 30 September (16.3.7) in the calendar.<ViewTransition> and see how much code goes away.bun upgrade on a side project or your test runner.Want the AI side in practice? I wrote about WebMCP, how websites talk to AI agents. And if your site or platform runs on Next.js and you'd like someone to handle the upgrade, get in touch: tell me what it runs on and we'll look at it together.