Next.js 16.4 introduces Cache Components as the default programming model, offering fast initial loads, instant client navigations, and declarative, opt-in caching. The release includes performance improvements like reduced memory usage, smaller bundles, and React 19.3 support, with new agentic tooling to help existing apps migrate.
Tode is an analytics platform designed specifically for Figma plugins and widgets, addressing limitations of traditional browser analytics tools by using the Figma plugin API to accurately track users, sessions, and custom actions in sandboxed iframe environments. The SDK supports multiple frameworks (React, Vue, Angular, Svelte, vanilla JS), offers flexible pricing from free to business tiers, and collects minimal user data while providing dashboards with metrics like daily active users, retention, and feature adoption.
CVE-2026-23870 is a denial-of-service vulnerability in Next.js server actions where an attacker can craft a malicious POST request with thousands of nested form pointers and fields, causing React's request parsing to perform millions of string checks on a single thread, freezing the server for seconds. The vulnerability requires no authentication and can be exploited by extracting the action ID from public HTML or JavaScript files.