- **AI SDK reached v6 (GA)** with composable agents, tool-loop abstraction, MCP support, and DevTools; patch cadence is rapid (v6.0.146 as of 2026-04-04). AI Gateway expanded to 30+ models including Gemini 3 Flash, GLM 5V Turbo, and Qwen 3.6 Plus.
- **Two CVEs disclosed in window:** CVE-2026-23864 (React Server Components DoS, affects Next.js 13-16) and CVE-2026-27979 (Next.js PPR memory exhaustion, fixed in 16.1.7). Vercel WAF auto-mitigated both for hosted projects.
- **Next.js 16.2 shipped March 2026** with ~400% faster dev startup, agent-ready scaffolding, browser-log forwarding, and 200+ Turbopack fixes.
- **Terms of Service update (March 2026)** introduced AI model-training clauses for Hobby/trial plans, with opt-out deadline of 2026-03-31 — drew significant community backlash over IP and compliance concerns.
- **Platform broadening continues:** Vercel CDN can now front non-Vercel apps (Discourse, WordPress); Sandboxes gained persistence and egress firewall; Observability Plus dropped its $10 base fee.
---
Next.js 16.2.x
Current Version
6
Release Lines
3
CVEs This Window
5
Active Trends
Release Timeline
Version / ProductCategory
Date
Notes
Next.js 16.2.xCurrent active / stable
Mar 2026
Latest minor; agent DevTools, perf gains
AI SDK 6.0.146Current active / stable
2026-04-04
Agents, MCP, tool approval, reranking
Next.js 16.1.7Current maintenance
Mar 2026
Security patch for CVE-2026-27979
Edge Middleware / Edge FunctionsLatest deprecated
Q1 2026
Replaced by unified Vercel Functions compute
N/APlanned / announced
—
No public roadmap items disclosed beyond current releases
**AI SDK 6:** Composable agents with `ToolLoopAgent`, tool execution approval flow, full MCP support, DevTools integration, image editing and reranking APIs. ([vercel.com/blog/ai-sdk-6](https://vercel.com/blog/ai-sdk-6))
**Edge Middleware deprecated:** Edge runtime now runs on Vercel Functions; pricing unified across all compute; Edge Middleware and Edge Functions names retired. ([vercel.com/changelog](https://vercel.com/changelog/edge-middleware-and-edge-functions-are-now-powered-by-vercel-functions))
**Turbo build machines** became the default for new Pro projects (Feb 2026).
**Observability Plus** dropped its $10/mo base fee; now purely usage-based. ([vercel.com/changelog](https://vercel.com/changelog/no-base-fee-for-observability-plus))
Security Advisories
CVE / AdvisorySeverity
Summary
Affected: Affected versionsFixed: Fixed in
CVE-2026-23864High
DoS via crafted HTTP requests to Server Function endpoints causing crashes, OOM, or CPU exhaustion. Vercel WAF auto-mitigated for hosted projects. ([vercel.com/changelog](https://vercel.com/changelog/summary-of-cve-2026-23864), [akamai.com](https://www.akamai.com/blog/security-research/cve-2026-23864-react-nextjs-denial-of-service))
Vercel is positioning itself as an AI application platform — AI SDK 6 agents, AI Gateway model marketplace (30+ models), MCP toolkits for Next.js and Nuxt, and agent-ready scaffolding in Next.js 16.2 all point to AI as the primary growth vector. ([vercel.com/blog/ai-sdk-6](https://vercel.com/blog/ai-sdk-6))
CDN-as-a-service expansion:
The ability to front non-Vercel apps (Discourse, WordPress) with Vercel's CDN, WAF, and bot management signals a move toward competing as an edge-network provider, not just a deployment platform. ([vercel.com/blog](https://vercel.com/blog/how-we-run-vercels-cdn-in-front-of-discourse))
Community friction on pricing and data:
Build-minutes billing enabled by default caused surprise charges; v0 pricing drew cancellations; the March 2026 ToS AI-training clause generated backlash over IP leakage and GDPR/SOC2 compliance risk. ([community.vercel.com](https://community.vercel.com/t/vercel-build-minutes-billing-enabled-by-default-causing-unexpected-charges/37434), [dev.to](https://dev.to/matscode/vercels-agentic-shift-is-your-proprietary-code-now-training-ai-402h))
Edge compute unification:
Deprecation of Edge Middleware/Edge Functions in favor of unified Vercel Functions simplifies the compute model but requires migration for teams relying on the old naming/pricing. ([vercel.com/changelog](https://vercel.com/changelog/edge-middleware-and-edge-functions-are-now-powered-by-vercel-functions))
Sandbox maturation:
Sandboxes gained automatic filesystem persistence, custom naming, and advanced egress firewall (SNI filtering, CIDR blocks) — positioning them for production-grade isolated compute use cases. ([vercel.com/changelog](https://vercel.com/changelog/advanced-egress-firewall-filtering-for-vercel-sandbox))