Next.js September 30 Security Release: 9 Vulnerabilities Including One Critical — Prepare to Upgrade Now

Next.js Is Dropping a Major Security Release on September 30, 2026

The Next.js team has officially announced a scheduled security release for September 30, 2026 — just three days away. The release will address nine vulnerabilities, including one critical, two high, five medium, and one low severity issue. Patched versions 16.3.7 and 15.5.27 will be published alongside full advisories.

The announcement was made on September 23, 2026 by Next.js core team members Josh Story, Karim Rahal, and Sebastian Silbermann via the official Next.js blog.

What We Know So Far

  • Release date: September 30, 2026
  • Patched versions: 16.3.7 (Active LTS) and 15.5.27 (Maintenance LTS)
  • Vulnerabilities addressed: 9 total — 1 critical, 2 high, 5 medium, 1 low
  • Full advisories including impact, affected versions, and upgrade instructions will be published with the release
  • Next.js 14.x is NOT in the fix list — users on version 14 will need to perform a major version upgrade, not just a patch

What You Should Do Right Now

  1. Audit your Next.js version — Run npx next --version or check your package.json to confirm which version you’re on.
  2. Plan your upgrade path — If you’re on 15.x, upgrading to 15.5.27 should be straightforward. If you’re on 16.x, target 16.3.7. If you’re on 14.x or earlier, start planning a major version migration now.
  3. Schedule maintenance windows — With a critical vulnerability in the mix, teams should be ready to deploy patches quickly after September 30.
  4. Subscribe to the Next.js security RSS feed — Stay ahead of future releases at nextjs.org/feed/security.xml.
  5. Monitor the official blog — Full details will be published at nextjs.org/blog/tag/security.

Why This Matters

A critical-severity vulnerability in Next.js can have serious implications for production applications. Next.js powers millions of websites and applications globally, making timely patching essential. The Vercel team’s advance notice gives developers a valuable window to prepare — use it.

This follows a pattern of proactive security communication from the Next.js team, who issued a similar advance notice before the September 22 release that patched two critical vulnerabilities in versions 16.3.6 and 15.5.26.

Key Takeaway

Mark September 30 on your calendar. When 16.3.7 and 15.5.27 drop, upgrade immediately. If you’re on Next.js 14.x, this is your signal to start planning a major version migration — the patch won’t cover you.

Hashtags: #NextJS #WebSecurity #JavaScript #Vercel #WebDevelopment #SecurityUpdate #ReactJS #OpenSource

Sources:

Search

Categories

Archives