On Tuesday Vercel shipped Next.js 16.3.6 and 15.5.26 with a one sentence release note: a security fix for remote code execution in next/og‘s ImageResponse. That is the component that turns a JSX tree into a social preview image on the server, on whatever input the URL gave it. If you have an /api/og route, this is not a Friday upgrade. It is a today upgrade.
Here is what mattered in React and React Native for September 21 to 27, 2026.
News
Next.js patches an RCE in next/og
Next.js 16.3.6 landed on September 22 alongside 15.5.26, both carrying the fix for advisory GHSA-vcvr-r3jv-pc5j, remote code execution in next/og ImageResponse. The 15.x release note calls it “additional security hardening”, which is the polite phrasing for the same thing. We run OG image routes on two of our marketing sites and they take a title from the query string, which is exactly the shape of input that makes an image renderer interesting to an attacker.
My take: the fix is easy and the discovery is the hard part. A dynamic OG route is the sort of thing you add in an afternoon two years ago and never look at again, because it works. Grep your repo for ImageResponse before you assume you are not affected. If you are on 14.x or older, you are not getting this patch and the decision has been made for you.
Expo wants the bug report to become the pull request
Expo published What if your app could fix itself? on September 22. The pitch: a user files a vague bug with no reproduction steps, an EAS Workflow hands it to an agent, the agent reproduces it on a cloud simulator, proposes a fix, and opens a pull request with before and after recordings attached. You review the diff and the video, then merge or not. Two days later EAS CLI 24.8.0 filled in the plumbing: eas simulator --build-fingerprint installs the newest build for a given fingerprint, workflow:ssh accepts build IDs, remote sessions gain launch_app_identifier, launch_args and open_url inputs so a simulator launches your app before the stream starts, and submissions accept individual App Store Connect API keys. There is also eas integrations:supabase:advisors, which lists unresolved Supabase security findings from the CLI.
I like the honesty of the framing. The agent does not merge anything, it produces evidence. Recordings of the app before and after are a better artefact than most human bug fixes ship with. Whether it is worth the simulator minutes depends entirely on how many of your bugs are the kind a screen recording can prove fixed. For UI bugs, plenty. For a race in a sync layer, no.
Worklet runtimes can now fetch
Software Mansion released react-native-worklets 0.13.0 on September 21. Worklet runtimes created in Bundle Mode now ship a standalone networking module: fetch, XMLHttpRequest, Blob, FileReader, Headers, Request, Response, FormData, AbortController and AbortSignal. It replaces the earlier networking preview and its FETCH_PREVIEW_ENABLED flag. createWorkletRuntime takes a new enableNetworking option, on by default and forced off on runtimes without an event loop. Peer range is still react-native: 0.86 - 0.88.
This matters more than it sounds. A worklet runtime that can make its own HTTP calls is a background thread with network access, which is the thing people have been faking with message passing back to the JS thread for years. Frame processors that upload a thumbnail, gesture handlers that log analytics without touching the UI thread. Also a new place for a request to originate that your network security config needs to know about.
Releases
React Native 0.88.0-rc.2 walks back a codegen change
0.88.0-rc.2 shipped September 22. The interesting entries are reverts: the RCTArrayBuffer codegen change is undone, restoring NSMutableData * for ObjC TurboModule methods that take or return an ArrayBuffer, and the rejection of ArrayBuffer as a TurboModule EventEmitter payload is gone too. The release note says why in plain words: 0.88 is a non breaking release, and both changes stopped modules that adopted ArrayBuffer support in 0.87 from compiling. Metro’s minimum is now 0.87.1 so upgraded projects resolve the same Metro as fresh ones, and the .js fallback for legacy deep imports of react-native/Libraries/* is back under the react-native-legacy-deep-imports condition.
Good release candidate behaviour. Somebody adopted a 0.87 feature, the RC broke them, the RC got fixed. That is what the RC period is for, and it only works if library authors actually build against RCs. If you maintain a native module, this is your nudge.
Skia 2.13.0 drops the legacy architecture
react-native-skia 2.13.0 on September 24 removes support for the legacy architecture, adds android.surfaceType to choose the Android backing view, passes GrContextOptions when creating the Metal direct context, and honours the optional paint and blend mode in drawPatch. Second feature release in two weeks after the SwiftPM one we covered last Monday, which for a library whose sponsor just announced it is leaving React Native is a reasonable sign of life. We keep our Skia guide pinned to the current release, so it moves to 2.13.0 in the next refresh.
Everything else that moved
React Navigation 8 pushed another alpha train on September 22 (stack alpha.57, native-stack alpha.56, core alpha.38 and the rest), with one flagged breaking change: navigation actions now carry and use an action source. TanStack Query 5.104.0 on September 26 is a build system release, every package now built with Vite 8, with 5.103.3 fixing a Solid SSR cleanup that crashed Astro. TanStack Router 1.170.40 and the Start packages picked up native scroll restoration on reload, path params parsed before server route handlers run, and a seroval bump that adds typed array length guards. Vite 8.3.1 handles server.ws: false in mergeConfig. Node 26.10.0 adds crypto.parsePKCS12(), fs.openAsBlobSync, FFI library loading from a mounted VFS and sending a net.BoundSocket to worker threads and child processes; Node 22.23.3 updated root certificates to NSS 3.125. Expo stable moved to 57.0.25 with 58.0.0-preview.7 on the next tag. react-native-maps shipped 1.29.9, 1.29.10 and 1.29.11 on Saturday alone, all Google Maps marker fixes on Fabric (icon kept when a marker is re-added, container re-attached after MapView removes it, icon view sized from Fabric layout metrics). If markers vanished on you after the 1.29.3 to 1.29.8 run we noted two weeks ago, this is the follow up, and our maps guide covers the tracksViewChanges side of that story.
Next.js 16.4 canaries 38 through 51 spent the week on the agentic upgrade path: the AI upgrade defaults to a separate worktree, works without Git, supports prerelease channels, shows security upgrade insights in DevTools, and the handoff runs on Sonnet 5 with a 1M context window according to the changelog. Also next analyze is promoted, and experimental custom webpack support was added in canary.41 and reverted in canary.46. Read that pair as a maintainer saying not yet.
Worth reading
Xcode 27 replaced Simulator with Device Hub
The r/reactnative thread of the week is a practical one: Xcode 27 replaced the Simulator app with Device Hub, and the poster’s point is that the data container feature is the real change, because you can now inspect what your app wrote to disk without a third party tool. For anyone about to write a security checklist for their app, that is also a reminder that whatever you store in the sandbox is one click from visible. Ours goes up Wednesday.
Two day one lists
Also on r/reactnative: Things I now set up on day one of every new React Native project and The performance checklist I run before shipping any React Native app. Both are opinionated and both disagree with me in places, which is the point of reading them. The first one is right about setting up crash reporting before writing a screen. The second one underrates how much of “performance” on Android is just image sizing.
Both official blogs were quiet again. No react.dev post since 19.3 on September 9, no reactnative.dev post since 0.87 in August, which fits a week where 0.88 is still in release candidates. If I missed something you shipped, tell me in the comments and it goes in next Monday.