Next.js August 2026 Security Release Is Live: Two Critical Vulnerabilities Patched in 16.3.3 and 15.5.24

Next.js August 2026 Security Release Is Live — Upgrade Now

The Next.js team has officially released the August 2026 security patch, and it’s more urgent than originally anticipated. What was initially announced as a fix for one critical vulnerability has expanded to address two critical severity vulnerabilities — prompting the team to move the release forward from August 26 to August 25, 2026.

If you haven’t upgraded yet, do it now.

🔴 What Was Released

  • Next.js 16.3.3 — Active LTS (recommended for most users)
  • Next.js 15.5.24 — Maintenance LTS

Both versions patch two critical severity vulnerabilities. The Vercel security team identified a second critical issue during the release preparation, which prompted them to accelerate the timeline and bundle both fixes into a single upgrade.

⚠️ Who Is Affected

All users running Next.js 16.3.x (below 16.3.3) or Next.js 15.5.x (below 15.5.24) are affected. The Vercel team strongly recommends upgrading as soon as possible.

🚀 How to Upgrade

Run the appropriate command for your version:

# For Next.js 16.x users (Active LTS)
npm install next@16.3.3

# For Next.js 15.x users (Maintenance LTS)
npm install next@15.5.24

After upgrading, verify your version:

npx next --version

🔒 About Next.js’s Security Program

The Next.js team works with security researchers through Vercel’s Open Source Bug Bounty program on HackerOne. This release is part of their new formal monthly security release cadence, introduced in July 2026, which provides advance notice of upcoming patches.

Full advisory details — including CVE identifiers, CVSS scores, impact descriptions, and affected version ranges — are available on the official Next.js security release blog post.

📋 Key Takeaways

  • Two critical vulnerabilities patched (upgraded from the originally announced one)
  • Release moved forward to August 25 to bundle both fixes
  • Upgrade to 16.3.3 (Active LTS) or 15.5.24 (Maintenance LTS)
  • Full advisory details available at nextjs.org/blog

Sources:

Hashtags: #NextJS #WebSecurity #JavaScript #WebDevelopment #Vercel #SecurityPatch #OpenSource

Search

Categories

Archives