Security

Next.js is preparing a scheduled security release for August 26, 2026.

• The release includes patches for Next.js 16.3 and 15.5.
• It will address one critical severity vulnerability.

The first monthly security releases are now available. Upgrade to 16.2.11 (Active LTS) or 15.5.21 (Maintenance LTS) now to address 4 HIGH and 5 MEDIUM severity vulnerabilities.

Next.js is moving to a formal release process for security updates.

• We will publish security patches more regularly, and will give advance notice of these patches.
• The first new security release is expected on July 21, 2026, and will address multiple security issues.