Blog
2 min read

Vercel Roundup: Sandbox Gets Private Networking, CDN Stops Caching Vary: Cookie

Vercel's late-September and early-October 2026 changes: Vercel Sandbox gained Secure Compute (static IP egress and AWS VPC peering) and memory observability, sandbox creation now returns a ready sandbox, Vercel CDN no longer caches responses with Vary: Cookie, Edge Requests were renamed CDN Requests, and skills.sh passed one million agent skills.

A handful of Vercel changes from the last two weeks of September and the first week of October 2026 are worth knowing about — one of them could change how your pages are cached. (What Is Vercel?)

Vercel Sandbox: private networking and readiness

Vercel Sandbox runs untrusted or AI-generated code in isolated environments. Recent updates:

  • Secure Compute support — sandboxes can connect to a team's dedicated network with static IP egress and reach private AWS VPC resources through VPC peering. That means a sandboxed agent can talk to an internal database or API without exposing it publicly.
  • Memory observability for sandboxes.
  • Sandbox creation now returns a ready sandbox (8 October), folding in startup time that used to happen on the first command — so timings are more consistent.
  • Earlier in September, Sandbox expanded from four regions to all of Vercel's compute regions.

Sandbox private networking is powerful and worth handling carefully: an agent with network access to internal systems needs tight scoping and egress rules. (Run Untrusted AI-Generated Code Safely, Agent Egress Control)

Vercel CDN no longer caches responses that include Vary: Cookie. Since every visitor's cookies differ, such responses were rarely shareable anyway, and caching them risked serving one user's personalised page to another. If you relied on caching for pages that send Vary: Cookie, expect more origin requests; split personalised fragments from cacheable ones instead. (HTTP Caching Headers, Next.js Cache Components)

Billing names and small pricing changes

  • Edge Requests are now called CDN Requests on bills and dashboards.
  • Microfrontends Routing requests that the Vercel Firewall denies, challenges or rate-limits are no longer billed (7 October).
  • An option to skip sending request bodies to Routing Middleware reduces Fast Origin Transfer usage (8 October).
  • Speed Insights deprecates First Input Delay on 1 November — it was replaced by INP as a Core Web Vital. (Core Web Vitals Explained)

Agents and skills

  • skills.sh, Vercel's agent skills registry, passed one million skills and nearly 280 million installs in about seven months. (Claude Code Skills)
  • Vercel Agent can install private packages from npm and custom registries.
  • AI Gateway added a stream of models, including Claude Sonnet 5.5 and Microsoft's MAI models.

Next.js

Next.js 16.4 shipped on 6 October, following a security release on 30 September. (Next.js 16.4, Next.js Security Release)

Source: Vercel Weekly, 5 October 2026 · Vercel changelog

EasySpawn is the self-hosted alternative for Next.js and other apps: your own server with HTTPS, Postgres and backups, with server-level pricing instead of per-request billing. See pricing or join the waitlist.

Related: Self-Hosting Next.js Without Vercel · Vercel vs Netlify vs Cloudflare Pages · Render vs Railway vs Fly · What Is Serverless?

Keep reading