---
title: Upcoming Next.js September Security Release
description: Next.js is preparing a scheduled September security release for September 30, 2026.
url: "https://nextjs.org/blog/upcoming-nextjs-security-release-september-2026"
docs_index: /docs/llms.txt
publishedAt: September 23rd 2026
authors:
  - Josh Story
  - Karim Rahal
  - Sebastian Silbermann
---



> **September 30, 2026:** This release now addresses seven vulnerabilities instead of nine. The remaining two (one **critical**, one **high**) are pending upstream coordination and will be addressed in a later Next.js release.

> **September 29, 2026:** Next.js [**16.3.7**](https://github.com/vercel/next.js/releases/tag/v16.3.7) was published with a bug fix. It does **not** include the security fixes planned for September 30. We now expect those fixes in **16.3.8** and **15.5.27**.

Next.js is preparing a scheduled security release for **September 30, 2026**. This advance notice gives teams time to plan upgrades before patches are published.

## Upcoming September release

The September 30 release will address seven vulnerabilities in Next.js: one **high**, five **medium**, and one **low**. We plan to publish **16.3.8** and **15.5.27** alongside the full advisories, including impact, affected versions, and upgrade instructions. We recommend upgrading to a patched version once the release is available.

## Our security program

We work with security researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).