Vercel confirmed on August 20 that Next.js will ship a scheduled security release on August 26, 2026, patching one critical-severity vulnerability. The fix lands in versions 16.3.3 and 15.5.24, according to the official Next.js blog. No CVE number or technical detail has been published yet; Vercel says the full advisory, including affected routes and upgrade instructions, goes live alongside the patch itself.
Part of a new, more predictable release cadence
This is the second release under Next.js’s new security release program, announced in July after the team moved away from shipping ad-hoc patches with zero advance warning. The first scheduled release, on July 21, patched four high and five medium severity issues in versions 16.2 and 15.5. Vercel says the shift followed a sharp rise in vulnerability research driven by LLM-assisted discovery tools, the same class of tooling that surfaced 271 issues in a single Firefox release earlier this year.
Going forward, Vercel plans to publish one of these advance notices roughly every month, each naming the release date and the worst severity it will contain. Anything urgent, or already being exploited, still gets patched immediately outside the schedule, the way React2Shell was handled last December.
What Next.js teams should do before August 26
Since no CVE or affected-surface detail is public yet, there’s nothing to patch today. But teams running Next.js in production, especially anything on the 16.x or 15.5.x line, should plan to update as soon as 16.3.3 or 15.5.24 land. A few things worth doing now:
- Check which Next.js version your production apps are actually running, not just what’s pinned in package.json.
- Have a deploy pipeline ready that can ship a patch release same day. “Critical” severity from Vercel has meant real, exploitable issues before.
- If you’re not already on 16.2 or 15.5 or later, catch up before August 26 so the upcoming patch applies cleanly.
For teams that don’t have the bandwidth to track framework security releases on their own calendar, this is exactly the kind of maintenance gap that shows up during a web application development audit, usually right before it becomes a real problem. It matters even more for SaaS products built on Next.js, where a delayed patch means a delayed fix across every customer at once.
