Upcoming Next.js September Security Release

Sebastian Silbermann,

Josh Story,

Karim Rahal

September 30, 2026: This release now addresses seven vulnerabilities instead of nine. The remaining two (one critical, one high) are pending upstream coordination and will be addressed in a later Next.js release.

September 29, 2026: Next.js 16.3.7 was published with a bug fix. It does not include the security fixes planned for September 30. We now expect those fixes in 16.3.8 and 15.5.27.

Next.js is preparing a scheduled security release for September 30, 2026. This advance notice gives teams time to plan upgrades before patches are published.

Copy link to headingUpcoming September release

The September 30 release will address seven vulnerabilities in Next.js: one high, five medium, and one low. We plan to publish 16.3.8 and 15.5.27 alongside the full advisories, including impact, affected versions, and upgrade instructions. We recommend upgrading to a patched version once the release is available.

Copy link to headingOur security program

We work with security researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].