--- title: Next.js Security Release and Our Next Patch Release description: Next.js is formalizing a scheduled security release program, moving away from ad-hoc patches. Going forward, advance notice of upcoming security releases will... canonical: https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Next.js Security Release and Our Next Patch Release | daily.dev og:description: Next.js is formalizing a scheduled security release program, moving away from ad-hoc patches. Going forward, advance notice of upcoming security releases will... og:url: https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu og:image: https://api.daily.dev/og/posts/MhdOM7XYU.png og:image:alt: Next.js Security Release and Our Next Patch Release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Next.js Security Release and Our Next Patch Release **[Next.js](https://daily.dev/sources/next)** · 3 min read · 6 upvotes · 1 comments ## Summary Next.js is formalizing a scheduled security release program, moving away from ad-hoc patches. Going forward, advance notice of upcoming security releases will be published monthly on the Next.js blog, including expected timelines and highest anticipated severity. The first scheduled release targets July 20, 2026, covering patches for Next.js 16.2 and 15.5 with fixes for 4 high and 5 medium severity vulnerabilities. Urgent or actively exploited vulnerabilities will still receive immediate ad-hoc patches. The program is supported by Vercel's Open Source Bug Bounty on HackerOne and internal tooling like deepsec. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When is the next scheduled Next.js security patch release and what versions does it affect? The first scheduled Next.js security release is planned for July 20, 2026, targeting patch releases for Next.js 16.2 and 15.5. It addresses multiple vulnerabilities, including 4 high severity and 5 medium severity issues. Full details, including any CVE identifiers, will be published once the patch is available. _Track Next.js security releases on daily.dev to time upgrades before deadlines like this one._ ### Is Next.js changing how it handles security patches? Yes, Next.js is moving from infrequent, no-notice ad-hoc security patches to a formal program with roughly monthly advance notices published on its blog. Each notice states the expected release timeline and the highest anticipated severity level, giving teams and hosting providers lead time to plan upgrades or deploy interim mitigations like firewall rules. Urgent, actively exploited vulnerabilities still get immediate ad-hoc patches outside this schedule. _Follow framework security process changes like this on daily.dev to keep production apps patched on time._ ### How is Next.js finding more security vulnerabilities before attackers do? Next.js increased vulnerability discovery through its own tool called deepsec, dedicated internal researchers, and an expanded bug bounty scope via Vercel's Open Source Bug Bounty program on HackerOne. This mirrors an industry-wide rise in LLM-assisted vulnerability research, exemplified by Mozilla disclosing 271 Firefox issues surfaced by Anthropic's Mythos Preview tooling. _Developers weighing framework security posture can follow these disclosure trends on daily.dev._ ## Similar posts on daily.dev - [Upcoming Next.js August Security Release](https://daily.dev/posts/upcoming-next-js-august-security-release-grrtb58k9) · Next.js · 7 upvotes · 0 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments - [Upcoming Next.js September Security Release](https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c) · Next.js · 19 upvotes · 3 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Next.js Security Release and Our Next Patch Release","url":"https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu"},"datePublished":"2026-07-13T18:13:09.603Z","dateModified":"2026-09-14T08:19:14.092Z","description":"Next.js is formalizing a scheduled security release program, moving away from ad-hoc patches. Going forward, advance notice of upcoming security releases will...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a34bd3f413f910d104ef0c3d2691d45?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a34bd3f413f910d104ef0c3d2691d45?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Next.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Next.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a7460ee33d92486cb5afd0fca36a116d","url":"https://daily.dev/sources/next"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,open-source,nextjs,vercel","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Next.js","item":"https://daily.dev/sources/next"},{"@type":"ListItem","position":3,"name":"Next.js Security Release and Our Next Patch Release"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/next-js-security-release-and-our-next-patch-release-mhdom7xyu#faq","mainEntity":[{"@type":"Question","name":"When is the next scheduled Next.js security patch release and what versions does it affect?","acceptedAnswer":{"@type":"Answer","text":"The first scheduled Next.js security release is planned for July 20, 2026, targeting patch releases for Next.js 16.2 and 15.5. It addresses multiple vulnerabilities, including 4 high severity and 5 medium severity issues. Full details, including any CVE identifiers, will be published once the patch is available. Track Next.js security releases on daily.dev to time upgrades before deadlines like this one."}},{"@type":"Question","name":"Is Next.js changing how it handles security patches?","acceptedAnswer":{"@type":"Answer","text":"Yes, Next.js is moving from infrequent, no-notice ad-hoc security patches to a formal program with roughly monthly advance notices published on its blog. Each notice states the expected release timeline and the highest anticipated severity level, giving teams and hosting providers lead time to plan upgrades or deploy interim mitigations like firewall rules. Urgent, actively exploited vulnerabilities still get immediate ad-hoc patches outside this schedule. Follow framework security process changes like this on daily.dev to keep production apps patched on time."}},{"@type":"Question","name":"How is Next.js finding more security vulnerabilities before attackers do?","acceptedAnswer":{"@type":"Answer","text":"Next.js increased vulnerability discovery through its own tool called deepsec, dedicated internal researchers, and an expanded bug bounty scope via Vercel's Open Source Bug Bounty program on HackerOne. This mirrors an industry-wide rise in LLM-assisted vulnerability research, exemplified by Mozilla disclosing 271 Firefox issues surfaced by Anthropic's Mythos Preview tooling. Developers weighing framework security posture can follow these disclosure trends on daily.dev."}}]} ```