Next.js development for fast, maintainable React apps

Next.js in 2026: what to know before you build or upgrade

This guide covers the decisions that shape cost and risk on a Next.js project: whether to use it at all, how Server Components and caching work, performance targets, hosting, upgrades and security. Everything here reflects the state of the framework in October 2026.

Next.js, plain React (Vite) or Astro?

If you are looking for a React.js development company in India or anywhere else, settle this question first, because it decides hosting, SEO and who you can hire.

Server Components, in plain terms

A Server Component runs only on the server. It can read the database directly, and none of its code is sent to the browser. A Client Component, marked with "use client", ships JavaScript and handles clicks and state. Well-built apps keep most of the tree on the server and push client components to the leaves. Two mistakes cause most trouble: marking a high-level layout as a client component, which drags everything below it into the bundle, and forgetting that Server Functions (Server Actions) are public HTTP endpoints. Every one needs input validation and an authorisation check of its own.

Caching: the part most teams get wrong

Caching in the App Router has changed twice. Next.js 15 stopped caching fetch requests and GET route handlers by default. Next.js 16 introduced Cache Components: you opt in explicitly with the "use cache" directive and a cacheLife profile, revalidateTag() now takes a profile as its second argument, and updateTag() gives read-your-writes behaviour inside Server Functions. Since 16.4, new apps get Cache Components by default, and the Next.js team has said it becomes the default model in Next.js 17. Our rule is to decide per route what may be stale, and for how long, before writing it. If you self-host on more than one instance, the cache must be shared, or users will see different versions of the same page.

Core Web Vitals targets

Google measures three Core Web Vitals at the 75th percentile of real visits, per web.dev:

• Largest Contentful Paint (LCP): 2.5 seconds or less.
• Interaction to Next Paint (INP): 200 milliseconds or less. INP replaced First Input Delay as a Core Web Vital in March 2024.
• Cumulative Layout Shift (CLS): 0.1 or less.

In Next.js apps, poor INP usually comes from large client bundles and heavy hydration, poor LCP from hero images without priority or slow server responses, and poor CLS from fonts, banners and embeds without reserved space. Judge progress with field data from Search Console or real-user monitoring, not a single lab score.

Hosting: Vercel, other platforms or self-hosting

Upgrade checklist: Next.js 14 or 15 to 16

1. Move to Node.js 24 or 26 first. Next.js 16 requires at least 20.9, and Node 20 itself is out of support.
2. Upgrade React to 19 and fix warnings before touching Next.js.
3. Run npx @next/codemod@canary upgrade latest, then the async request API codemod if any synchronous params, searchParams, cookies() or headers() calls remain.
4. Rename middleware.ts to proxy.ts. Proxy runs on the Node.js runtime; middleware remains only for edge use and is deprecated.
5. Check custom webpack configuration. Turbopack is now the default, and --webpack is a temporary escape hatch, not a plan.
6. Add a cacheLife profile to every revalidateTag() call, and replace experimental.ppr with Cache Components.
7. Replace next lint with ESLint or Biome run directly, and swap images.domains for remotePatterns. Note the new image defaults, including a four-hour minimum cache time.
8. Compare screenshots and end-to-end tests before and after, then release behind a staged rollout.

Security patching: what we commit to

Next.js has had serious vulnerabilities. CVE-2025-29927, published in March 2025 and rated critical (CVSS 9.1), let attackers bypass authorisation checks done in middleware by sending a crafted x-middleware-subrequest header; it was fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3. In December 2025, CVE-2025-55182, a pre-authentication remote-code-execution flaw in React Server Components rated 10.0, was added to CISA’s Known Exploited Vulnerabilities catalogue within two days of disclosure. Since July 2026 Next.js has run a formal security release programme, announcing scheduled releases roughly once a month and still shipping urgent fixes out of band.

For clients on a support plan we agree patch windows by severity, apply scheduled releases inside them, apply critical fixes faster, test before every deploy and keep a log. We also never rely on proxy.ts alone for access control: authorisation is checked again where the data is read.

When not to use Next.js

• A brochure or blog site that a CMS or Astro would serve with less code and cheaper hosting.
• An internal dashboard with no SEO needs, where a Vite single-page app is simpler.
• A team with no capacity to upgrade at least twice a year.
• Heavy back-end processing, which belongs in a separate API rather than route handlers.

What drives the cost of a Next.js project

• Distinct page types and how much of each is personalised rather than cacheable.
• Integrations: headless CMS, commerce, search, authentication, payments.
• Performance targets and how far the current app is from them.
• Hosting model: self-hosting needs more infrastructure work up front.
• Upgrade debt: an app on 13 or 14 with custom webpack takes longer than one already on 15.
• Ongoing patching under a support plan.

We do not publish prices; a written proposal follows a short discovery.

How to choose a Next.js agency

• Ask what they would build your project in if not Next.js, and why.
• Ask how they decide caching per route and how they handle multi-instance self-hosting.
• Ask for their patching routine and how quickly they applied the 2025 fixes.
• Look for performance budgets in CI, not a one-off Lighthouse screenshot.
• If you plan to hire Next.js developers through them, talk to those developers before signing.
• Make sure the repository, hosting account and domain are yours.