Next.js September 30 Security Release Is Live: Upgrade to 16.3.8 or 15.5.27 Now

Next.js September Security Patches Are Now Available

The Next.js team has officially released the September 30, 2026 security update. The patched versions — Next.js 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS) — are now available on npm and address seven vulnerabilities: one high, five medium, and one low severity.

If you haven’t upgraded yet, now is the time. Here’s everything you need to know.

What Changed From the Original Announcement?

When the release was first announced on September 23, it was expected to address nine vulnerabilities including one critical. The final release addresses seven vulnerabilities — the critical and one other were resolved or reclassified before the patch shipped. The severity breakdown is:

  • High: 1
  • Medium: 5
  • Low: 1

How to Upgrade

Run the appropriate command for your Next.js version:

# For Next.js 16.x (Active LTS)
npm install next@16.3.8

# For Next.js 15.x (Maintenance LTS)
npm install next@15.5.27

After upgrading, verify your installation:

npx next --version

Who Is Affected?

All Next.js users on the 15.x and 16.x branches should upgrade immediately. Users on older versions (13.x, 14.x) are encouraged to migrate to a supported release, as security patches are only being backported to the 15.x and 16.x lines.

Key Takeaways

  • Patched versions: 16.3.8 and 15.5.27 are live now
  • 7 vulnerabilities addressed (1 high, 5 medium, 1 low)
  • No critical severity issues in the final release
  • Upgrade is straightforward — no breaking changes expected
  • Vercel deployments are automatically protected

Stay Ahead of Security Releases

The Next.js team now publishes advance notice of security releases. You can follow nextjs.org/blog or watch the Next.js GitHub repository to stay informed about upcoming patches.

Hashtags: #NextJS #WebSecurity #JavaScript #WebDevelopment #Vercel #SecurityUpdate #ReactJS

Resources:

Search

Categories

Archives