August 25, 2026: The August security release originally targeted for August 26 is now expected on August 25, 2026 and will address two critical severity vulnerabilities. Read the update.
As part of the security release process we announced in July, Next.js is preparing a scheduled security release for August 26, 2026. This advance notice gives teams time to plan upgrades before patches are published.
Upcoming August release
The August 26 release will address one critical severity vulnerability. We plan to publish 16.3.3 and 15.5.24 alongside the full advisory, including impact, affected versions, and upgrade instructions. We recommend upgrading to a patched version once the release is available.
Our security program
We work with security researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.
Any questions or concerns regarding our security programs or vulnerability management can be sent to security@vercel.com.