Upcoming Next.js Security Update for a Critical Upstream Issue

Sebastian Silbermann,

Josh Story,

Karim Rahal

September 22, 2026: Next.js 16.3.6 and 15.5.26 are now available. Read the security update.

A critical security issue has been identified in an upstream dependency. We plan to publish Next.js 16.3.6 and 15.5.26 in an out-of-band update on September 22, 2026.

The full advisory, GHSA-vcvr-r3jv-pc5j, will be published with the update and include impact, affected versions, and upgrade instructions. Upgrade to Next.js 16.3.6 or 15.5.26 as soon as they are available.

Copy link to headingOur security program

We work with security researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].