Payload CMS & Next.js 16: Compatibility Breakthrough

I recently wrote about the critical npm supply chain vulnerability affecting Next.js and React that scored a perfect 10.0 on the CVSS scale. If you're running Payload CMS, you might have felt stuck between a rock and a hard place. You want to upgrade to Next.js 16 for security, but Payload doesn't officially support it yet. Until recently, staying on older Next.js versions was mostly a cosmetic concern about missing new features. Now it's a matter of security importance.

The good news? There's real progress happening, and the main blocker has been resolved.

Where Things Stand with Payload and Next.js 16

The Payload team has been actively working on Next.js 16 compatibility. If you've been following the GitHub discussions, you know developers have had mixed experiences. Some reported smooth upgrades on simpler sites, while others hit dependency issues and problems with removed Next.js internals like next/config. The experience has been inconsistent enough that most in the community have been recommending to wait for official support.

The official work is tracked in Pull Request #14456 on the Payload repository. This PR represents the effort to bring full Next.js 16 compatibility to Payload CMS.

The Turbopack HMR Breakthrough

The biggest obstacle preventing smooth compatibility was a Turbopack Hot Module Replacement bug. Developers were encountering an error that made development practically impossible: "Could not find the module X in the React Client Manifest." This issue, tracked as #85883 in the Next.js repository, affected anyone trying to use Payload with Next.js 16's Turbopack bundler.

Here's why this matters: Turbopack is Next.js's new bundler designed to replace Webpack, offering significantly faster builds and hot reloading during development. When HMR breaks, your development experience becomes frustrating at best and completely blocked at worst. Every code change requires a full rebuild instead of instant updates.

The Vercel team recently merged a fix for this Turbopack HMR issue. This removes the primary technical barrier that was preventing Payload from working smoothly with Next.js 16.

Why This Matters Now More Than Ever

The timing of this progress couldn't be better. As I detailed in my article about the CVSS 10.0 vulnerability, staying on outdated versions of Next.js is no longer just about missing out on performance improvements or new features. There's a legitimate security concern with the npm supply chain attack that affects older versions.

When compatibility issues are cosmetic, you can justify waiting. When they're security-related, the calculation changes entirely. Having Payload work properly with Next.js 16 means you won't have to choose between using your preferred CMS and maintaining a secure application.

What to Expect Next

With the Turbopack HMR fix now merged into Next.js, we're expecting the Payload team to release a patch that officially supports Next.js 16. The groundwork has been laid in PR #14456, and with the main technical blocker resolved, it's now a matter of testing and finalizing the integration.

If you're currently running Payload on an older Next.js version, this is the time to prepare. Review your project's dependencies, check for any custom configurations that might conflict with Next.js 16, and keep an eye on the Payload changelog. When the official compatibility patch drops, you'll want to upgrade promptly given the security implications.

The development community's mixed experiences during the early testing phase will likely smooth out once the official support lands. The Payload maintainers have been responsive throughout this process, and the progress we're seeing suggests they understand the urgency.

Wrapping Up

The path to Payload CMS working seamlessly with Next.js 16 is clearing up. The Turbopack HMR bug that was the main roadblock has been fixed, and the Payload team is actively working on compatibility. For developers who need both Payload's content management capabilities and Next.js 16's security fixes, relief is on the horizon.

Keep watching the Payload GitHub repository for updates, and be ready to upgrade when official support lands. The combination of security necessity and technical progress means we should see a stable solution soon.

Let me know in the comments if you have questions about the upgrade path or your specific Payload setup, and subscribe for more updates on Next.js and Payload development.

Thanks, Matija