Next.js September Security Patches Are Now Available
The Next.js team has officially released the scheduled September 30, 2026 security update. Versions 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS) are now available on npm, addressing nine vulnerabilities — including one critical, two high, five medium, and one low severity issue.
This release was pre-announced on September 23, 2026, giving teams time to plan their upgrades. Today is the day to act.
🚨 What’s Being Fixed
The September 30 release addresses nine CVEs across the Next.js framework:
- 1 Critical severity vulnerability
- 2 High severity vulnerabilities
- 5 Medium severity vulnerabilities
- 1 Low severity vulnerability
Full CVE details and security advisories are being published alongside the release on the Next.js blog and GitHub Security Advisories.
⚡ How to Upgrade
Run one of the following commands depending on your current Next.js version:
# For Next.js 16.x (Active LTS)
npm install next@16.3.8
# For Next.js 15.x (Maintenance LTS)
npm install next@15.5.27
# Verify your version
npx next --version📋 Who Is Affected
- Next.js 16.x users — upgrade to 16.3.8
- Next.js 15.x users — upgrade to 15.5.27
- Next.js 13.x and 14.x users — these versions are EOL; you must migrate to 15.x or 16.x to receive security patches
🔒 Background: Next.js Security Release Program
Since July 2026, the Next.js team has operated a formal monthly security release program, providing advance notice of upcoming patches. This September release is the third in that series, following the July 2026 release (9 CVEs) and the August 2026 release (2 Critical CVEs including RCE vulnerabilities).
The Vercel security team works with researchers through the Vercel Open Source Bug Bounty program on HackerOne. Security questions can be directed to security@vercel.com.
✅ Key Takeaway
Don’t wait — upgrade your Next.js applications to 16.3.8 or 15.5.27 today. With one critical and two high-severity vulnerabilities in this batch, delaying puts your production applications at risk.
Hashtags: #NextJS #WebSecurity #JavaScript #Vercel #WebDevelopment #SecurityUpdate #CVE
Resources: