Next.js 15 Reaches End of Life: What You Need to Know and How to Upgrade to Next.js 16

Next.js 15 Is Now End of Life — Time to Upgrade

As of October 21, 2026, Next.js 15 has officially reached its End of Life (EOL), closing out its two-year Maintenance LTS window. This means the 15.x line will no longer receive guaranteed security patches, bug fixes, or critical updates from the Vercel team. If your application is still running on Next.js 15, now is the time to act.

What “End of Life” Actually Means

Under the Next.js support policy, each major version goes through two phases:

  • Active LTS: New features, fixes, and security patches land here.
  • Maintenance LTS: Only critical bug fixes and essential security updates for two years from the original release date.

Next.js 15 shipped on October 21, 2024. Next.js 16 shipped on October 21, 2025. The math is simple: the maintenance window for 15 closed on October 21, 2026. From this point forward, any new vulnerability discovered in Next.js 15 will not receive a guaranteed patch.

The Security Risk Is Real

This isn’t just a formality. In 2026 alone, the Next.js team published 41 security advisories between January and September. The October 14, 2026 out-of-band patch — one of the last to cover Next.js 15 — fixed three serious vulnerabilities:

  • 🚨 Critical RCE in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr)
  • 🚨 Critical RCE in Image Optimization API with SVG files via the upstream sharp library (CVE-2026-96889)
  • ⚠️ High-severity DoS in App Router Server Actions (GHSA-p3m5-59mp-jv5r)

The October 14 patch (Next.js 15.5.28) is very likely one of the last security fixes that will ever ship for the 15.x line. Every new flaw discovered after today stays open on Next.js 15.

What Changes in Next.js 16

The good news: Next.js 16 is a well-supported, feature-rich upgrade. Here are the key changes to be aware of:

Breaking Changes (Build Will Fail)

  • Node.js 20.9+ required — Node 18 is no longer supported
  • Async params/cookies/headers — synchronous access is removed; all must be awaited
  • Turbopack is now the default for production builds — custom webpack configs may break the build
  • next lint is removed — linting now runs through ESLint or Biome directly
  • Parallel routes require default.js — missing files will cause build failures

Behavioral Changes (Sneaky, No Build Error)

  • middleware.ts → proxy.ts — runs on Node.js runtime only, not edge
  • Image caching extended from 60 seconds to 4 hours by default
  • Local IP images blocked by default (SSRF protection)
  • serverRuntimeConfig and publicRuntimeConfig removed — use environment variables instead

How to Upgrade

The Next.js team provides a codemod to handle the mechanical parts of the migration:

# Automated upgrade (recommended)
npx @next/codemod@canary upgrade latest

# With a coding agent
npx next@canary upgrade --agent=latest

After running the codemod, manually review your build output, test images, caching behavior, authentication flows, and any redirects in a staging environment before deploying to production.

Key Takeaways

  • ✅ Next.js 15 is officially EOL as of October 21, 2026
  • ✅ No more guaranteed security patches for 15.x
  • ✅ Next.js 16 (currently 16.4.2) is in Active LTS — upgrade now
  • ✅ Use the official codemod to automate the migration
  • ✅ Test thoroughly in staging before going live

Hashtags: #NextJS #WebDevelopment #JavaScript #Security #NextJS16 #EOL #WebSecurity #React #Vercel #FrontendDevelopment

Sources & Resources:

Search

Categories

Archives