Next.js 16

Apply to Next.js 16 App Router and Pages Router applications on the Node.js runtime. Use a maintained Node.js line; Node.js 20 satisfies the framework's engine requirement but no longer receives security fixes. The deprecated Edge runtime and output: 'export' lack several controls below. The included baselines are Node.js 24, React 19 and TypeScript 7: on Node.js 22 or 26, a Pages Router app on React 18, or TypeScript 5.9 or 6.0, apply the Node.js, React or TypeScript prompt for the installed line instead. Next.js supports the 16 major as one line and ships its security releases on the newest minor of each supported major, backporting to older minors only in rare cases, so follow 16's newest minor and check API availability there; the cache, navigation and development settings below include 16.4 APIs. App Router runs the React server build compiled into Next.js; changing the application's React dependency alone does not replace it.

Server boundaries and data access

• Put privileged reads and writes in a server-only data access layer; import server-only in modules containing credentials or privileged database clients. Authenticate the current request and authorize its tenant, object and operation there. Recheck on every Server Action, Route Handler and Pages API entry point, including direct RSC, prefetch, rewritten and localized requests.
• Treat Proxy redirects, layout checks, hidden components, opaque action IDs and 'use server' as routing or execution behavior, not access control. Stop execution after an authorization failure before returning protected data