# Next.js Security Update, React 19.3, Bun 1.4: September 2026 Dev News

> Next.js 16.3.6 fixes a critical RCE: upgrade now. Plus React 19.3, Bun 1.4 in Rust, Claude Opus 5.5, GPT-6 and Chrome 153, from the official notes.

By Salaheddine Elfatimi, Full Stack Developer in Marrakech. Published 26 September 2026. Updated 26 September 2026.
Canonical: https://salaheddine-elfatimi.com/blog/nextjs-security-update-september-2026

## Key takeaways

- Next.js 16.3.6 fixes a critical remote code execution bug in the Node.js ImageResponse (next/og); versions 16.2.0 to 16.3.5 are affected.
- Next.js 16.3.7 is announced for 30 September with fixes for nine more vulnerabilities.
- React 19.3 makes <ViewTransition> and Fragment refs stable and adds use(browser()) to skip server rendering.
- Bun 1.4 is rewritten from Zig to Rust, with 5× lower idle CPU and 1,517 more Node.js tests passing.
- Claude Opus 5.5 ($4/$20 per million tokens) and GPT-6 Luna ($0.10/$0.50) make capable AI models cheaper.

September 2026 brought one release you should act on today and four worth knowing. The **Next.js security update** (16.3.6) fixes a critical remote code execution bug in `next/og`: if you're on 16.2.0 to 16.3.5, upgrade now. React 19.3 makes `<ViewTransition>` stable, Bun 1.4 is rewritten in Rust, Claude Opus 5.5 and GPT-6 make capable AI models cheaper, and Chrome 153 adds `<camera>` and `<microphone>` elements.

![The five releases of the month. Start with Next.js: it's a security fix.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-cover-313009ef.webp)

Every fact below comes from the official release page, linked in each section. I build client sites and platforms on Next.js and React, so I read these notes anyway; this is the short version, with what I'd actually do.

[Video: The same news in under two minutes, explained in Moroccan Darija.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-reel-darij-74dfbe33.mp4)

## 1. Next.js security update 16.3.6: who is affected?

On 22 September the Next.js team shipped an [out-of-band security update](https://nextjs.org/blog/nextjs-security-update-september-22-2026). The issue is in the Node.js `ImageResponse` implementation of `next/og`, the API many sites use to draw their share images. Under specific conditions, improper escaping in the SVG that Satori generates could lead to remote code execution. It's rated **critical**.

- **Affected:** Next.js `>=16.2.0 <16.3.6`.
- **Not affected by the RCE:** the Edge `ImageResponse`, and Next.js 15.x (15.5.26 still ships related hardening).
- **The fix:** 16.3.6 upgrades Satori and the other upstream dependencies involved.

```
npm install next@16.3.6    # for 16.3
npm install next@15.5.26   # for 15.5 (hardening only)
```

![Three steps: check your version, upgrade, redeploy and check your share images.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-nextjs-pat-45eee539.webp)

It's the second Next.js security update in a month. On 25 August, [16.3.3](https://nextjs.org/blog/august-2026-security-release) fixed two other critical bugs: an AVIF image optimisation RCE (AVIF optimisation is disabled until the upstream fix lands) and a Windows-only RCE (CVE-2026-75604). And the team has [announced 16.3.7 for 30 September](https://nextjs.org/blog/upcoming-nextjs-security-release-september-2026), with fixes for nine more vulnerabilities, one of them critical. Plan an upgrade window that week too.

This site runs on Next.js 16.3.6 already. If your site or platform uses Next.js and you're not sure which version it's on, `npm ls next` in the project tells you in a second.

![The official post: affected versions, the advisory IDs and the upgrade commands.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-next-e9452a14.webp)

## 2. React 19.3: ViewTransition and Fragment refs are stable

[React 19.3](https://react.dev/blog/2026/09/09/react-19-3) (9 September) moves two APIs out of experimental. `<ViewTransition>` animates elements as they enter, exit, move or resize, using the browser's View Transition API. For a lot of page and list animations you no longer need an animation library.

```
import { ViewTransition } from 'react';

{isShowing && (
  <ViewTransition>
    <Component />
  </ViewTransition>
)}
```

Fragment refs are stable too, and react-dom gets a new `browser()` helper. A component that calls `use(browser())` opts out of server-side rendering: on the server it suspends and the nearest Suspense fallback goes into the HTML; once hydrated in the browser it renders normally. Handy for anything only the browser knows, like the visitor's time zone.

```
import { use } from 'react';
import { browser } from 'react-dom';

function Component() {
  use(browser());

  // ...
}
```

Also in 19.3: Trusted Types support (React passes trusted values through so your policies work), and Server Components can render a Context imported from a `'use client'` module directly, without a wrapper component.

![The React 19.3 post on react.dev.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-react-9c62cfb9.webp)

## 3. Bun 1.4: rewritten from Zig to Rust

[Bun 1.4](https://bun.com/blog/bun-v1.4) came out on 20 August. The headline is under the hood: Bun is rewritten from Zig to Rust. The numbers from the release post:

- **+1,517 tests** from the Node.js test suite now pass, the biggest jump in Node.js compatibility since Bun 1.0.
- **5× lower** idle CPU, **up to 35%** less memory, **50% faster** startup on Linux.
- Over **2,900 issues** fixed.
- New built-ins: `Bun.Image`, `Bun.WebView`, `Bun.markdown`, `Bun.cron()` (registers a job with crontab, launchd or Task Scheduler) and `Bun.Terminal`.

```
await Bun.file("photo.jpg")
  .image()
  .resize(1024, 1024, { fit: "inside" })
  .rotate(90)
  .webp({ quality: 85 })
  .write("thumb.webp");
```

Upgrade with `bun upgrade`. My take: try it on scripts, tooling and tests first; move a production server once your own dependencies pass on it.

![The Bun 1.4 release post.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-bun-cc04f89e.webp)

## 4. AI models: Claude Opus 5.5 and GPT-6 Sol and Luna

Two releases on the same day, 22 September, both about getting strong models for less. [Claude Opus 5.5](https://www.anthropic.com/claude-opus-5-5) performs at the level of Claude Fable 5.1 on most work. Anthropic's tests show it costs 40% less to run than Opus 5 on typical workloads, and it generates output more than 30% faster. The token price itself is 20% lower: $4 per million input tokens and $20 per million output tokens. The model ID is `claude-opus-5-5`.

OpenAI released [GPT-6 Sol and GPT-6 Luna](https://developers.openai.com/api/docs/changelog), two reasoning models in the Responses and Chat Completions APIs. Sol is built for complex coding and agentic workflows; Luna is OpenAI's most efficient model for focused, high-volume tasks.

| Model | Input / 1M tokens | Output / 1M tokens | Made for |
| --- | --- | --- | --- |
| Claude Opus 5.5 | $4 | $20 | Fable 5.1-level work, cheaper and faster than Opus 5 |
| Claude Fable 5.1 | $10 | $50 | The most capable Claude (released 1 September) |
| GPT-6 Sol | $2 | $10 | Complex coding and agentic workflows |
| GPT-6 Luna | $0.10 | $0.50 | Focused, high-volume tasks |

For the features I build into client platforms (an AI tutor, support answers, summaries), a price drop like this matters more than benchmark points: the same feature costs less every month. Prices are from [Anthropic's](https://platform.claude.com/docs/en/models/fable-5-1/overview) and [OpenAI's](https://developers.openai.com/api/docs/models/gpt-6-luna) model pages.

![The Claude Opus 5.5 announcement, 22 September 2026.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-claude-37aea1aa.webp)

## 5. Chrome 153: camera and microphone elements, and releases every two weeks

[Chrome 153](https://developer.chrome.com/release-notes/153) reached stable on 8 September. The feature I'll use first: `<camera>` and `<microphone>`, declarative HTML controls that ask for one capability each. The browser draws the control, and nothing is requested until the user clicks it. For live classes and video calls, that's a cleaner permission flow than calling `getUserMedia()` from your own button.

- `scroll-axis-lock`: a CSS property to stop the browser locking a scroll gesture to one axis (useful for maps and big tables).
- JavaScript: `Iterator.zip()` and `Iterator.zipKeyed()`, and a method to join an iterator into a string.

And the bigger change: from Chrome 153, a new stable version ships [every two weeks](https://developer.chrome.com/blog/chrome-two-week-release). Features reach users faster, and it's one more reason to test on the current Chrome before each release of your own.

![The Chrome 153 release notes.](https://salaheddine-elfatimi.com/uploads/2026/09/developer-news-september-2026-chrome-231dc815.webp)

## What should you do this week?

- Apply the Next.js security update: run `npm ls next` on every project and upgrade to 16.3.6. Put 30 September (16.3.7) in the calendar.
- On React projects, replace a small hand-made animation with `<ViewTransition>` and see how much code goes away.
- Try `bun upgrade` on a side project or your test runner.
- If you pay for an AI feature, check whether Opus 5.5 or GPT-6 Luna does the same job for less.

Want the AI side in practice? I wrote about [WebMCP, how websites talk to AI agents](https://salaheddine-elfatimi.com/blog/what-is-webmcp). And if your site or platform runs on Next.js and you'd like someone to handle the upgrade, [get in touch](https://salaheddine-elfatimi.com/#contact): tell me what it runs on and we'll look at it together.

## Frequently asked questions

### Which Next.js versions are affected by the September 2026 security issue?

Versions from 16.2.0 up to 16.3.5 that use the Node.js ImageResponse from next/og. The Edge ImageResponse and Next.js 15.x are not affected by the remote code execution; 15.5.26 adds related hardening.

### How do I apply the Next.js security update?

Run npm install next@16.3.6 (or next@15.5.26 on 15.5), rebuild and redeploy. Check that your share images still render. Plan another upgrade for 16.3.7, announced for 30 September.

### Is Bun 1.4 ready to replace Node.js in production?

It passes 1,517 more tests from the Node.js test suite than before, the biggest compatibility jump since 1.0. Try it on tooling and tests first, and move a production server once your own dependencies pass on it.

### Is Claude Opus 5.5 really 40% cheaper?

Anthropic says it costs 40% less to run than Opus 5 on typical workloads. The token price is 20% lower: $4 per million input tokens and $20 per million output tokens.