---
title: Upcoming Next.js Security Update for Upstream Vulnerabilities
description: Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
url: "https://nextjs.org/blog/upcoming-nextjs-security-update-october-2026"
docs_index: /docs/llms.txt
publishedAt: October 8th 2026
authors:
  - Josh Story
  - Karim Rahal
  - Sebastian Silbermann
---



Next Wednesday, **October 14, 2026**, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two **Critical** and one **High**. Two of these fixes were postponed from the September security release due to upstream coordination.

We will publish the full advisories with the update, including impact, affected versions, and upgrade instructions. Upgrade to a patched version as soon as the update is available.

## Our security program

We work with security researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).