Upcoming Next.js Security Update for Upstream Vulnerabilities

Sebastian Silbermann,

Josh Story,

Karim Rahal

Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination.

We will publish the full advisories with the update, including impact, affected versions, and upgrade instructions. Upgrade to a patched version as soon as the update is available.

Copy link to headingOur security program

We work with security researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].