---
title: Upcoming Next.js September Security Release
description: Next.js is preparing a scheduled September security release for September 30, 2026.
url: "https://nextjs.org/blog/upcoming-nextjs-security-release-september-2026"
docs_index: /docs/llms.txt
publishedAt: September 23rd 2026
authors:
  - Josh Story
  - Karim Rahal
  - Sebastian Silbermann
---



Next.js is preparing a scheduled security release for **September 30, 2026**. This advance notice gives teams time to plan upgrades before patches are published.

## Upcoming September release

The September 30 release will address nine vulnerabilities in Next.js: one **critical**, two **high**, five **medium**, and one **low**. We plan to publish **16.3.7** and **15.5.27** alongside the full advisories, including impact, affected versions, and upgrade instructions. We recommend upgrading to a patched version once the release is available.

## Our security program

We work with security researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel-open-source). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).