Back to Radar

Next.js

Next.js Intelligence

Name: Next.js bug intelligence
Creator: AI & Agent Dev Bug Sandbox

Published reports for this stack, with severity, affected version, and a direct path into each diagnostic.

Similar Reports

high95%

A stale "use cache" hit replaces its own entry in the Resume Data Cache with the background revalidation, so dev reports uncached data and the runtime prefetch loses the entry

When a request receives a stale cached entry from a "use cache" function, the background revalidation incorrectly replaces the saved entry in the Resume Data Cache with the pending result of the regeneration. This leads to dev-time "uncached data" errors on validation renders and in production to runtime prefetch/RSC responses missing or mixing cache versions when using cacheComponents and partialPrefetching.

V16.3.5 V16.3.8 V16.4.0 V16.5.0-Canary.3 Next.js

high80%

Dynamic pages stuck on loading.tsx when JavaScript is disabled

With App Router, dynamic pages using revalidate=0 or no-store fetch and a global loading.tsx get stuck on the loading fallback when JavaScript is disabled, making content invisible to crawlers and harming SEO.

V13.4.3 Next.js

high90%

Next.js 15.5.23 bundles vulnerable postcss and sharp dependencies

Running `npm audit` on a project created with Next.js 15.5.23 reports high severity vulnerabilities from transitive dependencies `postcss` and `sharp`. The Next.js package pins outdated versions of these packages, requiring a dependency bump to secure patch releases.

V15.5.23 Next.js

high75%

Regression: next/dynamic conditionally importing client components adds both to client bundle in Next.js 15

Next.js 15 preloads all dynamic imports inside client components, causing both conditional chunks to be sent to the client, increasing initial JavaScript size and TBT compared to Next.js 14. The issue requires a user-land workaround until an upstream fix is released.

V15.3.3 Next.js

high85%

Invisible navigation-menu viewport blocks clicks and text selection after dropdown closes

On supabase.com, opening and closing a navbar mega-menu leaves a permanently mounted container (forceMount) that overlays hero content and intercepts pointer events, preventing text selection and CTA clicks.

Next.js

high68%

Turbopack: "type": "commonjs" in package.json breaks every App Router source file

Setting `"type": "commonjs"` in a Next.js project using Turbopack causes build and dev failures because Turbopack enforces the declared module format on App Router source files (which are written as ESM) and on generated `.next-internal` server-action entries, even though Webpack ignores this field. The issue affects all App Router files and internal virtual modules, not just the `'use client'` proxy previously fixed.

V15.5.26 V16.3.5 V16.3.6 V16.4.0-Canary.43 Next.js

high78%

Optimistic routes wrongly predict rewritten pages, causing locale mismatch

When optimisticRoutes is enabled and a path is rewritten (e.g., /team → /en/team), the client applies an optimistic navigation state based on the unrewritten URL. This incorrectly sets the locale (or other dynamic params) to the raw path segment instead of the rewritten value, leading to flashing 404s, wrong data fetching, or transient wrong locale rendering until the server response resolves.

V16.3.1-Canary.7 Next.js

high95%

Server Action responses bypass deploymentId version skew detection, crashing stale tabs with "module factory is not available"

When a deploymentId is configured, Server Action responses do not include the x-nextjs-deployment-id header, so stale clients cannot detect version skew and attempt to apply incompatible flight data, causing a Turbopack runtime crash.

V16.3.6 V16.4.0-Canary.43 Next.js

high95%

CSS url() imports resolve incorrectly when using matchResource (`!=!`) with mini-css-extract-plugin

The bundled mini-css-extract-plugin v2.4.4 in Next.js does not respect matchResource (`!=!`) in importModule, causing relative asset paths in CSS url() to resolve against the wrong directory. This breaks asset references for any webpack loader using matchResource to emit CSS. Fixed upstream in mini-css-extract-plugin v2.10.2.

Next.js

high92%

partialPrefetching causes four renders per on-demand page, timer-retained render state leads to large memory spikes

With partialPrefetching enabled, dynamic pages are rendered four times per request (request, runtime prefetch, shell upgrade x2). Timers scheduled during each render capture AsyncLocalStorage context and retain large React Flight request and cache state, causing memory retention of ~3.8 MiB per request for a 10-minute timer, up to 45 GiB at 20 rps.

V16.3.5 V16.3.6 V16.4.0-Canary.39 Next.js

high85%

Middleware rewrites are network-proxied when using `next start -H 127.0.0.1`, causing EPROTO 500 behind TLS-terminating proxies

When Next.js is started with `-H 127.0.0.1` behind a reverse proxy that sets `X-Forwarded-Proto: https`, middleware rewrites targeting the same server are incorrectly treated as external and proxied over the network using the `https` scheme against the plain-HTTP port, resulting in `write EPROTO ... wrong version number` and a 500 response. The root cause is an asymmetric normalization of loopback hostnames between the router server's `initUrl` and the URL exposed to middleware.

V16.2.6 V16.3.0-Canary.49 Next.js

high73%

next/image: cancelled image request hangs that image until server restart

A cancelled request to /_next/image leaves a stale in-flight promise in the image optimization cache, causing subsequent requests for the same image URL to hang indefinitely until server restart.

V15.5.x V15.5.25 Next.js

high72%

Socket rewrites connection reuse can lead to a race condition and intermittent 500s

Next.js 16.3.x uses httpxy for rewrites with a shared keep-alive agent, which can reuse an idle socket at the same moment the upstream closes it, causing a race condition that intermittently returns 500 on the second socket connection.

V16.3.0-Canary.98 V16.3.6 Next.js

high85%

Turbopack 在文件变更后 loader 先使用旧内容执行导致缓存陈旧

在 next dev 使用 Turbopack 时，编辑经过 turbopack.rules 配置的 loader 处理的文件会触发 loader 链执行两次。第一次调用传入文件旧内容，第二次传入新内容。对于依赖文件 mtime 或自行读取文件系统的 loader（如 @tailwindcss/turbopack），可能导致缓存陈旧，最终输出滞后一个编辑版本。Webpack 模式无此问题。

V16.3.6 Next.js

high85%

next/jest loads server runtime into Jest process causing process listener leak

next/jest transformer imports server runtime code that monkey-patches process event methods, causing test file process.on() calls to attach listeners to the real Jest process, leading to memory leaks across test files.

V16.3.4 V16.4.0-Canary.47 Next.js

high95%

Next.js crypto wrappers stack across realms causing memory leak on repeated server starts

Starting Next.js in a new JavaScript realm (e.g., Jest test files) wraps shared crypto functions without idempotency checks, leading to wrapper chains that retain previous realms and leak ~7.7 MB per realm.

V16.3.4 V16.4.0-Canary.47 Next.js

high78%

notFound() returns HTTP 200 instead of 404 when streaming is enabled by root loading.tsx and sibling dynamic route

When a route with dynamicParams:false calls notFound(), it returns 200 with not-found UI if a root loading.tsx and a sibling dynamicParams:true route exist. The 404 status is lost during streaming; the incremental cache stores a 200 response.

V16.3.4 V16.3.6 V16.4.0-Canary.50 Next.js

high85%

Failed request from abandoned navigation triggers full page reload

When a slow RSC fetch for a route fails after the user has navigated to another page via client-side navigation, Next.js incorrectly performs a full page load to the abandoned route's URL, disrupting the user experience.

V16.4.0-Canary.50 Next.js

high95%

Reusing fetch options removes `next` configuration and can break prerendering

Next.js server fetch patch mutates the caller's RequestInit object by deleting the `next` and `cache` fields, causing subsequent fetches with the same options object to lose cache configuration. This leads to prerender errors and broken dev caching when Cache Components are enabled.

V16.4.0-Canary.48 Next.js

high92%

Empty `useServerInsertedHTML` results still trigger a React render for each streamed chunk

In Next.js App Router, when a `useServerInsertedHTML` callback returns an empty Fragment (or null, empty array), the server still performs an additional React render for each streamed chunk because the callback result is always wrapped in a keyed Fragment, preventing the existing empty-result optimization in `getServerInsertedHTML()`. This leads to significant performance overhead in streaming scenarios with many Suspense boundaries.

V16.3.6 V16.4.0-Canary.48 V16.4.0-Canary.50 Next.js

high85%

Unbounded per-path ISR cache control growth in long-lived next start processes

SharedCacheControls stores cache-control metadata for every ISR path in a static Map without any eviction or bound, causing heap memory to grow without limit in production next start servers that generate many distinct ISR paths.

V16.4.0-Canary.48 V16.4.0-Canary.50 Next.js

high87%

On-demand ISR revalidation reports success but serves stale content when a background render is in-flight

In Next.js Pages Router, calling res.revalidate('/') after a content publish can return success while the next request still serves the pre-publish version. This occurs when a normal background ISR render is already in-flight and reads data before publication; the on-demand revalidation reuses that in-flight render, and the stale result is persisted with a fresh cache timestamp.

V16.3.6 V16.4.0-Canary.48 V16.4.0-Canary.50 Next.js

high95%

Route handler code no longer preloaded on next start since 16.3

Next.js 16.3 introduced a regression where route handler modules are not eagerly evaluated at startup, causing the first request to a route handler to pay full module evaluation cost. This increases cold start latency and p99 for deployments.

V16.3.0 V16.3.1 V16.3.2 V16.3.3 V16.3.4 V16.3.5 V16.3.6 V16.4.0-Canary.50 Next.js

high75%

Turbopack dev server hangs indefinitely with CPU spin when stdout pipe reader exits

When the stdout of `next dev` (Turbopack) is piped to a reader that exits early (e.g., `head -N`), subsequent requests hang forever and the process consumes CPU (~1.3 cores) in a native spin. The server stops responding while TCP connections are accepted but never answered.

V16.2.11 V16.3.0-Canary.96 Next.js

high90%

Duplicate Location and x-nextjs-stale-time headers in Next.js 15.4.1+ when using redirect/permanentRedirect with force-static

Next.js 15.4.1 introduced a regression where redirects combined with dynamic 'force-static' cause duplicate Location and x-nextjs-stale-time response headers. This can lead to malformed redirect URLs (e.g., '/redirect,/redirect') depending on how clients process the duplicate header.

V15.4.1 V15.4.2 V15.4.3 V15.4.4 Next.js

high95%

Route announcer crashes with `removeChild` after browser translation

AppRouterAnnouncer crashes after Chrome browser translation when the route announcement becomes empty. Chrome's translation replaces the text node, and React's `removeChild` fails because the node is no longer a child. Wrapping the announcement in a `<span key={routeAnnouncement}>` stabilizes reconciliation and avoids the crash.

V16.4.0-Canary.37 Next.js

high85%

next/link prefetches across routers in mixed App/Pages apps causing 404s and wasted RSC requests

In mixed App Router and Pages Router applications, Pages Router links to App Router routes trigger erroneous `_next/data` prefetch requests that return 404, and App Router links to Pages Router routes send RSC prefetch requests that receive HTML documents instead of Flight data.

V16.3.6 V16.4.0-Canary.51 Next.js

high87%

Next.js 16 static export: RSC payload path mismatch causes 404 errors on prefetch

In Next.js 16.0.0–16.3.5 with `output: 'export'`, the generated RSC payload files use a directory-based path (`__next/page/__PAGE__.txt`), but the browser requests a flat dotted filename (`__next.page.__PAGE__.txt`), leading to 404 errors during link prefetching on statically exported sites.

V>=16.0.0 <=16.3.5 Next.js

high75%

Middleware redirects drop _rsc by causing RSC header mismatch and cache poisoning risk

Redirects issued from proxy.ts via NextResponse.redirect lose the `_rsc` query parameter while retaining the RSC request header, leading to an extra 307 validation redirect and potential cache poisoning when a shared cache keys on the URL.

V16.4.0-Canary.46 Next.js

high88%

Mount-time setState in layout-level client ancestor forces client render of pending streamed Suspense boundary

When a client ancestor of a streamed Suspense boundary (e.g., a root layout provider) calls setState on mount while the boundary is still pending, React discards the server-rendered HTML and mounts the boundary as client-rendered, causing visible flash and duplicate elements. startTransition does not mitigate the issue.

Vreact@19.2.7 Vreact@19.3.0 Vnext@16.2.10 Vnext@16.3.6 Next.js