<p><strong>TLDR:</strong> A high-severity DoS vulnerability in Next.js App Router affects versions 13.x through 16.x and requires an upgrade — Vercel’s WAF alone isn’t enough. Zustand has officially passed Redux in popularity, which feels like a long time coming. Tailwind CSS 4.2 ships a native webpack plugin and a 3.8x recompilation speedup. Safari Technology Preview 241 and Chrome 147 both landed with meaningful CSS and web API additions.</p>
<hr>
<h2>Next.js DoS vulnerability in App Router (CVE-2026-23869)</h2>
<p>A CVSS 7.5 vulnerability affects React Server Components in Next.js 13.x through 16.x. A crafted HTTP request to any App Router Server Function endpoint can trigger excessive CPU usage during deserialization, causing denial of service. Vercel has deployed WAF mitigations for hosted projects, but the advisory is clear that WAF protection alone is not sufficient — you need to upgrade to 15.5.15 or 16.2.3. If you’re running App Router in production, this is the thing to deal with today.</p>
<hr>
<h2>Zustand officially more popular than Redux</h2>
<p>Zustand has crossed Redux in popularity. It’s been trending that way for a while, but the milestone is now official. The shift reflects what a lot of teams have already figured out in practice: Redux’s ceremony doesn’t pay off for most apps, and Zustand’s minimal API gets out of your way. Worth noting alongside this: a post today specifically calls out teams misusing Zustand by applying Redux-style patterns — global state for local UI, subscribing to entire store objects, monolithic store shapes. Popularity doesn’t automatically mean people are using it well.</p>
<hr>
<h2>Tailwind CSS 4.2 ships webpack plugin and 3.8x recompilation speedup</h2>
<p>Tailwind 4.2.0 adds a first-class webpack plugin, which means projects not on Vite no longer need manual PostCSS configuration to get proper integration. The release also adds four new muted color palettes (mauve, olive, mist, taupe), expands logical property utilities for RTL layouts, and delivers a 3.8x recompilation speed improvement across all integrations. An automated migration tool exists for teams on v3, though the release notes flag some rough edges around <code>@apply</code> in component libraries.</p>
<hr>
<h2>Chrome 147 and Safari TP 241 land CSS and API updates</h2>
<p>Chrome 147 stable ships CSS <code>border-shape</code> and <code>contrast-color()</code>, the Web Printing API for isolated web apps, WebXR Layers and Plane Detection, and new Local Network Access restrictions on WebSockets and WebTransport. WebNN moves from developer trial to origin trial. Safari Technology Preview 241 adds the <code>stretch</code> keyword for box sizing, stable CSS scroll anchoring, <code>auto</code> in the <code>sizes</code> attribute on <code>&lt;img&gt;</code>, and Cookie Store API <code>maxAge</code> support, plus performance fixes for <code>ResizeObserver</code> and <code>IntersectionObserver</code>.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Storybook 10.3</strong> adds MCP support for React so AI agents can discover design system components, write stories, and run accessibility tests; CSF Factories now extend to Vue, Angular, and Web Components; adds support for Vite 8, Next.js 16.2, and Angular 21.</li>
<li><strong>React Native 0.85</strong> ships a new Shared Animation Backend (co-built with Software Mansion) enabling native driver support for Flexbox/layout props, plus TextInput selection data in onChange events, Metro TLS support, and a standalone <code>@react-native/jest-preset</code> package.</li>
<li><strong>Angular 18 data fetching patterns</strong> — a practical rundown of the current recommended approach: <code>inject()</code> for HttpClient, <code>signal()</code> over <code>BehaviorSubject</code>, and <code>toSignal()</code> as the bridge from RxJS observables to Signals.</li>
<li><strong>WebCodecs deep dive</strong> covers hardware-accelerated frame-level video encoding and decoding in the browser, including a working mp4-to-webm converter; the critical production note is calling <code>frame.close()</code> explicitly to avoid VRAM exhaustion.</li>
<li><strong>CSS <code>border-shape</code></strong> (Chrome 147+) lets you create shapes while preserving borders, shadows, and outlines — something <code>clip-path</code> and <code>mask</code> can’t do; accepts the same value syntax as <code>clip-path</code>.</li>
<li><strong>WebAIM Million 2026 report</strong> (via Frontend Focus) shows web accessibility is declining, with AI-assisted coding and third-party frameworks cited as contributing factors.</li>
<li><strong><code>prefers-reduced-motion</code> implementation guide</strong> argues the right approach is a different interaction model per component — not stripping all animation — using 0.01ms duration as a CSS safety net and <code>useReducedMotion</code> from Motion for live reactivity.</li>
<li><strong>Linked typing pattern in TypeScript</strong> — using <code>keyof typeof</code> with <code>as const</code> to derive union types directly from runtime objects, eliminating manual type declarations that drift out of sync.</li>
<li><strong>Gemma Gem Chrome extension</strong> runs a Google Gemma model entirely locally via WebGPU with no API key; acts as an autonomous agent with six browser tools including JS execution, which has raised security concerns given full DOM access.</li>
<li><strong>HTML audio/video lazy-loading</strong> is becoming a web standard, arriving in Chrome 148 as a developer trial in Chrome 147.</li>
<li><strong>Axios npm supply chain compromise</strong> flagged in the This Week In React roundup — worth checking your lock files.</li>
<li><strong>Vercel Microfrontends</strong> now support an AI skill installable via <code>npx skills add vercel/microfrontends</code> and new CLI commands for group management.</li>
<li><strong>Storybook 10.3 accessibility pass</strong> fixed hundreds of issues in Storybook’s own UI — not exciting, but relevant if you’re using it in environments with accessibility requirements.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A high-severity DoS vulnerability (CVE-2026-23869, CVSS 7.5) in Next.js App Router affects versions 13.x–16.x; upgrading to 15.5.15 or 16.2.3 is required as Vercel's WAF alone is insufficient. Zustand has officially surpassed Redux in popularity, though misuse patterns persist. Tailwind CSS 4.2 ships a native webpack plugin and a 3.8x recompilation speedup. Chrome 147 and Safari TP 241 bring CSS border-shape, contrast-color(), and various web API additions. Also covered: Storybook 10.3 with MCP support, React Native 0.85, Angular 18 data fetching patterns, WebCodecs deep dive, an Axios npm supply chain compromise, and more.

Next.js DoS vulnerability needs patching, Zustand overtakes Redux