Przemysław Zalewski

Next.js, with and without Vercel

A Next.js developer who will also tell you when Next.js is the problem

App Router, Server Components, streaming, caching rules nobody remembers. I ship Next.js when it earns its place and rescue apps where it did not: one week of measuring, then the fixes with the biggest effect.

Book a free 30‑min call Email me instead

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
9years of TypeScript, React and Node.js
2017first React app in production
~2/3of merged PRs in 2026 built with AI coding agents, nearly all through my review or merge
300+generated sites deployed automatically

Sound familiar?

Next.js problems I fix in 2026

Another critical Next.js security update: who patches our app?

On 14 October 2026 Next.js shipped an out‑of‑band fix for two critical unauthenticated remote code execution bugs, one with no known workaround (Next.js blog). The fixes landed in 16.4.1 and 15.5.28; 14.x gets none.

I patch the same day and redeploy once your tests pass. In October 2025 I hardened a Next.js app before a third-party pentest: a nonce-based CSP through middleware, JSON‑only APIs that force a preflight against CSRF, and HSTS preload.

Still on Next.js 14: does it still get security fixes?

No. Next.js lists 14.x as unsupported: only 16 (Active LTS) and 15 (Maintenance LTS) get patches, and 15’s original end date of 21 October 2026 has been extended to a date not yet announced (Next.js support policy).

I take the app to 16 in steps you can revert: the official codemods first, then the breaking changes one pull request at a time, each behind tests and a preview deploy. I have taken apps across Next.js majors three times: two to Next.js 15 in late 2024, and Patriot Mail to Next.js 16 in October 2025, two days after its release, with React Compiler and Turbopack on.

Sound like you? Book a free 30‑min call →

Vercel bill keeps growing: should we self-host Next.js?

Vercel Pro is now a $20 monthly usage credit, rolled out to all teams from October 2025, and Vercel itself expected about 7% of teams to pay more (Vercel).

I first measure what drives the bill, for example dynamic rendering on pages that could be static. Then you get one recommendation with the cost of each path: tune it on Vercel or move off it. In March 2026 I fixed failing deploys of a Next.js app by keeping tests and native app sources out of its serverless functions, then cut the largest from 47 MB to 7 MB; in April I moved all 74 API routes into a standalone container estimated at a fifth to a tenth of the memory.

Next.js site slow on mobile and failing Core Web Vitals?

The Web Almanac 2025, published in January 2026, found that only 48% of mobile websites pass Core Web Vitals (HTTP Archive). A slow page loses the visitors you paid for in ads and SEO.

I find what slows the page on real phones: request waterfalls, force-dynamic on pages that could be static, JavaScript that never needed to ship. Each fix comes with its numbers before and after. In July 2026 an email app on Next.js took from a few to several dozen seconds to show the current mailbox; after I moved reads to a local database, each next page loaded in 88 to 219 ms, with end‑to‑end time budgets that fail the build if it slows down again.

Facing one of these? Book a free 30‑min call →

Why me

A slow app fixed, with numbers before and after

A hundred requests on first load, force-dynamic everywhere, a regression on every minor bump. I measure first, then fix the three things that matter, then hand you a checklist for the rest.

Pages that paint before the data is ready

One HTML response, the slow parts fill in as they finish, no hydration where none is needed. I built this for agent output (case below). Next.js does it too, if nobody fights the defaults.

Off Vercel or all-in: an honest call

Self-hosted Next.js on a Node.js server or Docker, or the static parts on Cloudflare. The honest answer sometimes is “stay and go all‑in on Vercel”. I will say which.

Security patches the same day

An advisory lands, your app is patched and redeployed that day, behind your tests. Then I sweep the code for the same bug class. The React2Shell timeline is in the case below.

Live demo

Waterfall versus stream

Three timelines, measured live in your browser. Waterfall: twelve requests in a row, the shape of a page that fetches in every component. Parallel: the same twelve at once. Stream: one HTML response from a Worker, five slots arriving out of order.

Demo loading…

Tick what applies to you under the timeline. These are the questions I ask on a rescue call, and the verdict changes as you tick.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Streaming agent output in one HTML request, no client framework

The problem
Agent output arrives out of order and takes a while. A page that waits for everything feels broken.
What I did
One HTML response streamed from the server, slots filled out of order as results arrive, no hydration, no client framework.
Result
First paint in milliseconds, the rest fills in live. The same idea runs the stream demo on the Next.js page.

streaming HTML no hydration

See also: JavaScript

Help center moved from WordPress into the repo as docs-as-code

The problem
An unmaintained WordPress help site: red in audits, no sitemap, expiring certificates, plugins nobody understood.
What I did
Markdown in the repo, versioned with the product, all languages generated automatically, interlinking, 301 redirects for every old address, help added to the Definition of Done.
Result
One machine less to break during holidays, docs that match the product, better SEO and GEO, context agents can read.

docs‑as‑code 301s i18n

See also: Cloudflare · Maintenance & CI/CD

Offer: Your company site off WordPress, in a few hours

Same-day response to React2Shell and other advisories

The problem
Critical advisories in React, Node.js, WordPress and OpenSSH land without warning and proof‑of‑concept scanners follow within days.
What I did
A fixed pattern: official source, patch the same day, WAF mitigation, a regex sweep of our own code for the same vulnerability class, hardening flags for Node.js, reading material for the team.
Result
React2Shell patched the day the advisory went out, days before public scanners went live.

same‑day patch WAF code sweep

See also: TypeScript & Node.js · Maintenance & CI/CD

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week Next.js code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature, and dashboards leadership reads instead of asking me for numbers.

Good to know

Next.js facts most teams learn in production

Next 15 stopped caching GET handlers

Since Next.js 15, GET Route Handlers and the client Router Cache are uncached by default. An app upgraded from 14 can suddenly hit the database far more often (Next.js 15).

Each self-hosted instance has its own cache

Self-hosted, the cache lives in memory (50 MB by default) and on disk per instance. revalidateTag() on one instance does not clear the others until you add a shared cacheHandler (self‑hosting guide).

“Failed to find Server Action” behind a load balancer

Every build gets its own Server Actions encryption key. With several instances, set NEXT_SERVER_ACTIONS_ENCRYPTION_KEY to the same value everywhere (self‑hosting guide).

nginx breaks streaming

Suspense streaming only works once proxy buffering is off, for example with X-Accel-Buffering: no. Without it the page arrives in one piece (self‑hosting guide).

middleware.ts is now proxy.ts

Next.js 16 replaced middleware.ts with proxy.ts on the Node.js runtime, requires Node 20.9 or later and no longer lints during next build (Next.js 16).

The middleware bypass was self-hosted only

CVE‑2025‑29927 used the internal x‑middleware‑subrequest header. Only next start and standalone deployments were exposed; the fix is 14.2.25 or 15.2.3 (Vercel postmortem).

FAQ

Questions people ask before they book

Should we leave Next.js?
Sometimes. If the product is a content site, probably not. If it is a long‑lived app with a stable API and you deploy outside Vercel, the framework may cost more than it gives. I run a short audit and give you the answer with numbers, including “stay”. If the answer is “plain React”, that work is on the React page.
What goes wrong with the App Router?
Fetch in every component with no cache plan, server actions used as an API, everything dynamic because one thing was, and upgrades that change caching semantics under your feet. I measure which one costs you the most and fix that first.
Can you deploy Next.js outside Vercel?
Yes: Node.js server, Docker on a VPS, or static export with the dynamic bits on Cloudflare Workers. I will tell you which features you lose and whether you used them.
What does a rescue cost and how long does it take?
Week one is the Next.js codebase audit, 30 to 40 hours with the price range shown above: measure, read, write the findings. Weeks two to four: the three fixes with the biggest effect, each behind a test. Then a checklist your team can run without me. It is the sprint-sized rung on the offer ladder.
Do you build new Next.js apps too?
Yes, when it fits: content-heavy sites, marketing plus app in one repo, teams that already know it. With a cache plan written down on day one.
How soon can you start?
From 3 November 2026. Book the call and we start with the measurement week.
Our team already uses Claude Code. What do you add?
Review capacity and rules. In 2026 I merged 260+ pull requests of my own and reviewed 300+ of other engineers’; about two thirds of the merged ones across two products were built with coding agents. I put the rules, hooks and CI gates into your repository, so your team’s agents keep working under them after I leave. More on the AI in your company page.
You are one person. What if it fails or you get sick?
Start small: the one‑week audit or one reviewed pull request, both priced before we start. Hourly work has no minimum, so you can stop at any time and keep everything delivered. Code, CI and docs live in your repository from the first commit, the contract transfers the copyright to you in writing, and every project keeps a runbook and architecture notes. If I am ill, you hear it the same day. How I work.
Why does my self-hosted Next.js show different data on each refresh?
Each instance keeps its own cache, and revalidateTag only clears the one it runs on. You need a shared cacheHandler plus one Server Actions encryption key for all instances (self‑hosting guide).
What breaks when upgrading to Next.js 16?
middleware.ts becomes proxy.ts, Node 20.9 is the minimum, revalidateTag takes a cacheLife profile and next/image defaults change: cache TTL goes to 4 hours and quality to 75 (Next.js 16).
Another critical Next.js security update: who patches our app?
On 14 October 2026 Next.js shipped an out‑of‑band fix for two critical unauthenticated remote code execution bugs, one with no known workaround (Next.js blog). The fixes landed in 16.4.1 and 15.5.28; 14.x gets none. I patch the same day and redeploy once your tests pass. In October 2025 I hardened a Next.js app before a third-party pentest: a nonce-based CSP through middleware, JSON‑only APIs that force a preflight against CSRF, and HSTS preload.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why is a Next.js app always thirsty?Punchline

Hydration errors. Ba‑dum‑tss.

What comes after Next.js?Punchline

Next.js. It’s always the next one. Ba‑dum‑tss.

Why doesn’t Next.js go to the gym?Punchline

Its bundle is already heavy enough. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

ReactInterfaces, tests and the dashboard that proves they work.Live demo CloudflareWorkers, Durable Objects, R2, Workers AI, with cost caps.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack