This is the release the maintainers flagged five days ago, out now with the full advisories attached. The nine fixes break down as one critical, two high, five medium, and one low. The ones you'll care about most: an SSRF reachable when a rewrites() or redirects() rule builds its destination host from request-controlled input, and a middleware bypass hitting App Router apps built with Turbopack that carry a single entry in config.i18n.locales — exactly the kind of gap that quietly defeats an auth check you thought you had. The patched versions are 15.5.27 on the LTS line and the matching 16.3.x build; the pre-announcement named 16.3.7 and later notes point to 16.3.8, so grab whatever nextjs.org lists as the September 30 release rather than pinning a number from memory. None of it is a breaking change — it's a straight patch. If you run middleware for auth, or use rewrites/redirects with dynamic hosts, do this one today.