---
title: Upcoming Next.js Security Update for a Critical Upstream Issue
description: Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
url: "https://nextjs.org/blog/upcoming-nextjs-security-release-september-22-2026"
docs_index: /docs/llms.txt
publishedAt: September 21st 2026
authors:
  - Josh Story
  - Karim Rahal
  - Sebastian Silbermann
---



A critical security issue has been identified in an upstream dependency. We plan to publish Next.js **16.3.6** and **15.5.26** in an out-of-band update on **September 22, 2026**.

The full advisory, [GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j), will be published with the update and include impact, affected versions, and upgrade instructions. Upgrade to Next.js 16.3.6 or 15.5.26 as soon as they are available.

## Our security program

We work with security researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel-open-source). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).