🚨 Critical Next.js Security Update — September 22, 2026
The Next.js team has announced an out-of-band critical security update dropping today, September 22, 2026. If you’re running any Next.js application, you need to upgrade immediately once the patches are available.
What’s Being Released
Two new versions are being published today to address a critical security vulnerability in an upstream dependency:
- Next.js 16.3.6 (Active LTS)
- Next.js 15.5.26 (Maintenance LTS)
The Vulnerability
The full advisory — GHSA-vcvr-r3jv-pc5j — will be published alongside the update and will include:
- Full impact assessment
- Affected versions
- Detailed upgrade instructions
The issue originates in an upstream dependency of Next.js, making this an out-of-band (unscheduled) release outside of the regular monthly security cadence.
How to Upgrade
Once the releases are live, run the appropriate command for your version:
# For Next.js 16.x users (Active LTS)
npm install next@16.3.6
# For Next.js 15.x users (Maintenance LTS)
npm install next@15.5.26Context: Next.js Security Program
This release is part of Next.js’s formal security release program, launched in July 2026. The program provides advance notice of security patches and works with researchers through Vercel’s Open Source Bug Bounty on HackerOne.
This is the third security release in the program following the July 2026 release (9 CVEs) and the August 2026 release (2 critical vulnerabilities).
Key Takeaways
- ✅ Upgrade to 16.3.6 if you’re on Next.js 16.x
- ✅ Upgrade to 15.5.26 if you’re on Next.js 15.x
- ⚠️ Next.js 15 reaches end of official support on October 21, 2026 — consider migrating to 16.x
- 🔍 Watch the GitHub Security Advisory for full CVE details
Questions or concerns about Vercel’s security programs can be directed to security@vercel.com.
Source: Next.js Official Blog
Hashtags: #NextJS #WebSecurity #JavaScript #ReactJS #WebDevelopment #CyberSecurity #Vercel #OpenSource