Dev48
Language
  • About
  • Services
  • Industries
  • Technologies
  • Articles
  • Contacts
Book a call
    Home/Articles/Upcoming nextjs security update for a critical upstream issue
Dev48

© 2026 · All rights reserved.

Upcoming Next.js Security Update for a Critical Upstream Issue

Источник: Next.js

Upcoming Next.js Security Update for a Critical Upstream Issue

Source: Next.js

Next.j 16.3.6 and 15.5.26 are planned for a critical out-of-band ecurity update on September 22, 2026.

September 25, 2026
September 22, 2026: Next.js 16.3.6 and 15.5.26 are now available. Read the security update.

September 22, 2026: Next.js 16.3.6 and 15.5.26 are now available. Read the security update.

A critical security issue has been identified in an upstream dependency. We plan to publish Next.js 16.3.6 and 15.5.26 in an out-of-band update on September 22, 2026.

The full advisory, GHSA-vcvr-r3jv-pc5j, will be published with the update and include impact, affected versions, and upgrade instructions. Upgrade to Next.js 16.3.6 or 15.5.26 as soon as they are available.

Our security program

We work with security researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to security@vercel.com.

← All articles

More in Software Development

All →
A new skill finds AI agent risks, fixes them, and proves the fix worked
Microsoft

A new skill finds AI agent risks, fixes them, and proves the fix worked

Some Supabase customers are publicly exposing reams of people’s data to the webПресса
Supabase

Some Supabase customers are publicly exposing reams of people’s data to the web

Blazor Basics: SEO Basics for Blazor Web Applications
Telerik

Blazor Basics: SEO Basics for Blazor Web Applications

Affected by layoffs? Don’t miss this $75 deal for your TechCrunch Disrupt 2026 Expo+ PassПресса
Expo

Affected by layoffs? Don’t miss this $75 deal for your TechCrunch Disrupt 2026 Expo+ Pass

Last 24 hours to save up to $200 on TechCrunch Disrupt 2026. Reason 5 of 5 to attend: MomentumПресса
Momentum

Last 24 hours to save up to $200 on TechCrunch Disrupt 2026. Reason 5 of 5 to attend: Momentum

We’re building Copilot as a new OS for work that spans every model, every form factor, and every task. Today, we’re announcing our biggest update to Copilot to date, bringing four things together [Read more]
Microsoft

We’re building Copilot as a new OS for work that spans every model, every form factor, and every task. Today, we’re announcing our biggest update to Copilot to date, bringing four things together [Read more]

More from Next.js

Upcoming Next.js September Security Release
Next.js

Upcoming Next.js September Security Release

Next.js Security Update for a Critical Upstream Issue
Next.js

Next.js Security Update for a Critical Upstream Issue

How we closed 1,500 GitHub issues in one month
Next.js

How we closed 1,500 GitHub issues in one month

How Turbopack chunks your JavaScript
Next.js

How Turbopack chunks your JavaScript