The Next.js team has issued an advance security notice: a scheduled patch release is coming on September 30, 2026. The upcoming release will address nine vulnerabilities – one critical, two high, five medium, and one low.
What is Coming on September 30
Next.js will publish two patched versions: Next.js 16.3.7 (Active LTS) and Next.js 15.5.27 (Maintenance LTS). Full security advisories will be published alongside the release.
Vulnerability Breakdown
- Critical: 1 vulnerability
- High: 2 vulnerabilities
- Medium: 5 vulnerabilities
- Low: 1 vulnerability
Why This Matters
This is the third significant Next.js security event in September 2026 alone. Earlier this month, an out-of-band critical patch (16.3.6 and 15.5.26) was rushed out on September 22 to address a critical upstream dependency issue. The frequency of security releases underscores the importance of keeping Next.js apps up to date.
What You Should Do Now
- Audit your current Next.js version – run npx next –version in your project.
- Plan your upgrade window for September 30 or shortly after.
- Test in staging before pushing to production.
- Subscribe to Next.js security notifications via the Next.js blog or Vercel HackerOne program.
- Check your deployment platform for any automated update options.
Key Takeaway: Mark September 30, 2026 on your calendar. With one critical and two high-severity vulnerabilities in the mix, this is not a patch release to defer.
Hashtags: #NextJS #WebSecurity #JavaScript #WebDevelopment #React #Vercel #SecurityUpdate #OpenSource
Source: Next.js Blog – Upcoming Next.js September Security Release