--- title: Next.js moves to monthly scheduled security releases description: Vercel is formalizing a monthly scheduled security release program for Next.js, replacing ad-hoc patches with a predictable cadence. The first scheduled... canonical: https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Next.js moves to monthly scheduled security releases | daily.dev og:description: Vercel is formalizing a monthly scheduled security release program for Next.js, replacing ad-hoc patches with a predictable cadence. The first scheduled... og:url: https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv og:image: https://api.daily.dev/og/posts/kn4SOnZHv.png og:image:alt: Next.js moves to monthly scheduled security releases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Next.js moves to monthly scheduled security releases **[Collections](https://daily.dev/sources/collections)** · 5 min read · 7 upvotes · 1 comments ## Summary Vercel is formalizing a monthly scheduled security release program for Next.js, replacing ad-hoc patches with a predictable cadence. The first scheduled release is July 20, 2026, covering Next.js 16.2 and 15.5 with fixes for 4 high and 5 medium severity vulnerabilities. The change was prompted by two major incidents: a CVSS 9.1 middleware authorization bypass in March 2025 and a CVSS 10.0 RCE flaw (CVE-2025-55182, dubbed React2Shell) exploited by state-linked groups. Vercel also cites LLM-assisted vulnerability discovery as a driver of increasing patch volumes industry-wide. The program is backed by a HackerOne bug bounty and internal tooling called deepsec, with the goal of giving self-hosted deployments enough lead time to plan upgrades. ## Content ## What changed and why Vercel is replacing Next.js's ad-hoc security patching with a monthly scheduled release program. Starting July 20, 2026, the Next.js blog will publish advance notice of upcoming releases, including expected timelines and the highest anticipated severity. Actively exploited vulnerabilities still get immediate patches outside the schedule, but routine fixes now ship on a predictable cadence. The shift follows two high-profile incidents that made the old approach look untenable. In March 2025, a CVSS 9.1 middleware authorization bypass let attackers skip authentication checks entirely. Then came CVE-2025-55182, dubbed React2Shell, rated CVSS 10.0 — unauthenticated remote code execution via the React Flight protocol. State-nexus groups (North Korean actors, specifically) had working exploits within hours of disclosure. That kind of turnaround time tends to concentrate minds. Vercel also points to a broader industry trend: LLM-assisted vulnerability discovery is inflating patch volumes everywhere. Mozilla shipped a 271-issue Firefox release. Microsoft's most recent Patch Tuesday fixed 570 vulnerabilities. Next.js isn't uniquely broken — the attack surface for complex frameworks is just getting more systematically probed. ## The July 20 release: nine vulnerabilities The first scheduled release patches v15.5.21 and v16.2.11, covering four high-severity and five medium-severity issues. **High severity:** - Server Actions CPU exhaustion (denial of service) - SVG-based Image Optimization abuse (denial of service) - SSRF via rewrites and redirects - SSRF via Server Actions on custom servers - Middleware/proxy bypass in Turbopack builds with a single i18n locale **Medium severity:** - Unbounded Server Action payload memory consumption in Edge runtime - Unauthenticated disclosure of internal Server Function endpoint IDs - Two cache confusion bugs in server-side fetch calls with request bodies Anyone running App Router with Server Actions should treat this as urgent. Self-hosted deployments are most exposed during the window between disclosure and completed upgrades — that gap is exactly what the scheduled program is designed to shrink. ## CVE-2025-55182: how the React Flight exploit actually worked The React Flight protocol streams data between server and client using a custom format where references are prefixed with `$`. The protocol reconstructs executable references, module imports, and RPC endpoints on the client side — which is powerful, and also a significant attack surface if the deserialization logic isn't careful. The root cause was a missing `hasOwnProperty` check in `getOutlinedModel`. Without it, an attacker could supply a `$:` path reference that traverses the prototype chain rather than the object's own properties. That traversal reaches the `Function` constructor. From there, arbitrary code execution is straightforward. The gadget chain in brief: malicious `$:` path → prototype chain traversal → `Function` constructor → RCE. No authentication required. The React team's patch adds the `hasOwnProperty` check to close the traversal path. But the broader lesson is that the Flight protocol's `$` prefix system — which handles module IDs, encrypted closures, and RPC endpoints — has structural complexity that rewards careful auditing. ## Defenses worth actually implementing Patching is the obvious first step. Beyond that, a few things meaningfully reduce exposure: **Schema validation on every Server Action.** Zod or Valibot on every input, before any business logic runs. This doesn't prevent RCE at the protocol level, but it limits what a successful deserialization attack can do with malformed payloads. **The `server-only` package.** Marks modules as server-exclusive at build time, preventing accidental client exposure of sensitive code paths. **CSRF hardening.** Server Actions are callable endpoints. Treat them like API routes for CSRF purposes. **The Taint API.** React's built-in mechanism for marking sensitive values so they can't be serialized to the client. Useful, but it's not a substitute for the above — it's a last-resort guardrail, not a primary defense. **WAF rules.** Can catch known exploit patterns in Flight stream payloads, though sophisticated attackers will vary their approach. ## Structural risks that patches don't fully address A few issues are worth keeping in mind even after upgrading: - **MITM on the Flight stream.** If the stream itself can be intercepted or tampered with in transit, the client-side reconstruction logic becomes an attack surface regardless of server-side fixes. - **Server Action enumeration.** The medium-severity disclosure of internal Server Function endpoint IDs (patched in July) is a reminder that these endpoints are discoverable. Obscurity isn't security, but unnecessary exposure doesn't help. - **Encrypted closure tampering.** Server Actions can capture closed-over values that get encrypted and sent to the client. Tampering with those encrypted blobs is a research area worth watching. - **Supply chain activation via module IDs.** The Flight protocol's module import system means a compromised dependency could potentially be activated through crafted module ID references. ## The program going forward Vercel's bug bounty runs through HackerOne. Internal tooling called `deepsec` is part of their vulnerability discovery pipeline. Monthly advance notices will appear on the Next.js blog before each scheduled release. The honest summary: the scheduled release program is a meaningful improvement over ad-hoc patches, but the underlying attack surface — Server Actions, the Flight protocol, Edge runtime memory handling — is genuinely complex. Staying current on versions matters more now than it did a year ago. ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 1 upvotes > Makes sense because these huge CVEs keep coming down the line. Better than random "quick update now before you get pwnd!!" ## Similar posts on daily.dev - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 130 upvotes · 4 comments --- Tags: [#security](https://daily.dev/tags/security), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Next.js moves to monthly scheduled security releases","url":"https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv"},"datePublished":"2026-07-16T05:15:54.545Z","dateModified":"2026-07-21T16:18:29.653Z","description":"Vercel is formalizing a monthly scheduled security release program for Next.js, replacing ad-hoc patches with a predictable cadence. The first scheduled...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ae0b318fa65c093cac44c55d9993232?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ae0b318fa65c093cac44c55d9993232?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,nextjs,vercel","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Next.js moves to monthly scheduled security releases"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/next-js-moves-to-monthly-scheduled-security-releases-kn4sonzhv","comment":[{"@type":"Comment","text":"Makes sense because these huge CVEs keep coming down the line. Better than random “quick update now before you get pwnd!!”","datePublished":"2026-07-17T12:40:01.301Z","url":"https://daily.dev/posts/kn4SOnZHv#c-A5Gpwmvnu","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} ```