Releasesby IbisSecurity Update: Next.js and React vulnerabilities (October 2026)
UpdateyesterdayUnverifiedAdded Oct 15, 2026
The Next.js and React teams have disclosed three security vulnerabilities (two critical, one high), released on October 14, 2026: a remote code execution (RCE) in SVG image processing, an RCE in use cache (Cache Components), and a denial of service (DoS) in App Router Server Actions. Here's what Netlify customers need to know.
Topics: Security, Developer tools
More Netlify releases
Every Netlify releaseTanStack Start 1.0 deploys on Netlify
TanStack Start is now 1.0, and Start apps deploy on Netlify. SSR, server routes, server functions, and middleware run on Netlify Functions. It's also what new Agent Runners projects start with by default.
Google Gemini 4 Argon now available in AI Gateway and Agent Runners
Google’s Gemini 4 Argon model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
Mistral Large 4 now available in Agent Runners
Mistral AI's Mistral Large 4 model is now available in Netlify Agent Runners. With a 524K-token context window, it’s built for agentic coding and long-context work, making it a good fit for multi-step tasks across larger codebases. Select it from the model picker to try it today. Learn more in docs.
Meta Models Now Available in AI Gateway
Meta’s Muse Spark and Muse Wonder models are now available through Netlify’s AI Gateway with zero configuration required. Choose muse-spark-1.1 for coding, computer use, and multimodal perception; muse-spark-1.2 for coding-optimized agentic workflows; muse-spark-1.3 for long-horizon coding and agentic work with cleaner code and fewer tokens; or...
Know who is visiting your protected site, right from your functions
On private projects and sites protected with Netlify team login, your Netlify Functions and Edge Functions can now see who is making the request. The signed-in Netlify user is available as context.user, with their user ID, email address, and when their access expires.
Subscribe to Netlify events from ChatGPT
You can now subscribe to Netlify events from ChatGPT and set up automations that respond to what’s happening on your sites. Instead of checking the Netlify dashboard or waiting on an email, you can have ChatGPT act as soon as something happens.
Claude Haiku 5.5 now available in AI Gateway and Agent Runners
Anthropic’s Claude Haiku 5.5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically.
OpenAI Decisions API now available in AI Gateway
OpenAI’s Decisions API is now available through Netlify’s AI Gateway with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions to classify, route, and score inputs without managing API keys.
Also shipped on Oct 14, 2026
Netlify in October 2026Workspace-level package repositories for Databricks Apps are generally available
Workspace admins can now configure default Python and npm package repositories for Databricks Apps. Apps inherit the workspace configuration while still allowing app-level overrides. See Configure default package repositories .
The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA)
The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA). This integration lets you use the metastore as a serverless, central metadata layer, enabling seamless data sharing and unified querying across Apache Spark, Apache Hive, and BigQuery.
Metadata migration from Dataproc Metastore to Lakehouse is now generally available (GA)
Metadata migration from Dataproc Metastore to Lakehouse is now generally available (GA). You can perform a one-time backfill migration or dry run to migrate metadata from a Dataproc Metastore service to an Apache Iceberg REST catalog endpoint or a Hive catalog endpoint using the Google Cloud console, the gcloud CLI, or the REST API.
Conversational analytics now lets you create a conversation with all of the data sources in multiple...
Conversational analytics now lets you create a conversation with all of the data sources in multiple projects, or create a conversation with a dataset . These features are generally available (GA).
You can publish a BigQuery Conversational Analytics agent in Gemini Enterprise
You can publish a BigQuery Conversational Analytics agent in Gemini Enterprise . This feature is now generally available (GA).
The AI.AGG function now supports the output_schema argument, which lets you specify the schema of the...
The AI.AGG function now supports the output_schema argument, which lets you specify the schema of the function output as a comma-separated list of fields. This feature is generally available (GA).