Upgrade Next.js Now: September 2026 Security Patch Guide
On September 30, 2026, the Next.js team released critical security patches addressing seven vulnerabilities – one High, five Medium, and one Low severity. The patched versions are Next.js 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS). If you have not upgraded yet, here is exactly how to do it safely and quickly.
Why You Should Upgrade Immediately
The September 2026 security release addresses vulnerabilities in the Next.js core. While full exploit details are intentionally withheld until most users have patched, the presence of a High severity vulnerability means your production applications could be at risk. Upgrading takes less than 5 minutes for most projects.
Step 1: Check Your Current Next.js Version
Before upgrading, confirm which version you are running:
npx next --versionIf you are on any version below 16.3.8 (for the 16.x line) or 15.5.27 (for the 15.x line), you need to upgrade.
Step 2: Upgrade Using Your Package Manager
Run the appropriate command for your package manager:
# npm
npm install next@latest
# yarn
yarn add next@latest
# pnpm
pnpm add next@latest
# bun
bun add next@latestIf you are on the 15.x Maintenance LTS line, pin to the specific version:
npm install next@15.5.27Step 3: Verify the Upgrade
After installation, confirm the new version is active:
npx next --version
# Should output: 16.3.8 or 15.5.27Step 4: Run Your Test Suite
Security patches are designed to be non-breaking, but it is always good practice to run your tests after any upgrade:
npm test
npm run devStep 5: Deploy to Production
Once you have verified the upgrade locally, deploy to production as soon as possible. The longer your production app runs on a vulnerable version, the greater the risk.
npm run buildUsing Payload CMS with Next.js?
If you are running Payload CMS (which installs directly into your Next.js app), the latest stable release is v3.90.2. Payload templates already track Next.js 16.x, so upgrading Next.js should be seamless. After upgrading, regenerate your Payload types:
pnpm payload generate:typesKey Takeaway
The September 2026 Next.js security release is a mandatory upgrade for all production applications. The process is straightforward – update your dependency, run your tests, and deploy. Do not delay: the High severity vulnerability in this release makes prompt action essential.
Hashtags: #NextJS #WebSecurity #JavaScript #WebDevelopment #NextJS16 #SecurityPatch #Vercel
Resources: