Next.js is formalizing a scheduled security release program, moving away from ad-hoc patches. Going forward, advance notice of upcoming security releases will be published monthly on the Next.js blog, including expected timelines and highest anticipated severity. The first scheduled release targets July 20, 2026, covering patches for Next.js 16.2 and 15.5 with fixes for 4 high and 5 medium severity vulnerabilities. Urgent or actively exploited vulnerabilities will still receive immediate ad-hoc patches. The program is supported by Vercel's Open Source Bug Bounty on HackerOne and internal tooling like deepsec.
Table of contents
A predictable release scheduleWhat to expectUpcoming July releaseOur security program32.2K Impressions1 Comment