--- title: Upcoming Next.js Security Update for a Critical Upstream... description: A critical security issue has been found in an upstream dependency used by Next.js. Vercel plans an out-of-band release of Next.js 16.3.6 and 15.5.26 on... canonical: https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Upcoming Next.js Security Update for a Critical Upstream Issue | daily.dev og:description: A critical security issue has been found in an upstream dependency used by Next.js. Vercel plans an out-of-band release of Next.js 16.3.6 and 15.5.26 on... og:url: https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago og:image: https://api.daily.dev/og/posts/UULTChAGo.png og:image:alt: Upcoming Next.js Security Update for a Critical Upstream Issue og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Upcoming Next.js Security Update for a Critical Upstream Issue **[Next.js](https://daily.dev/sources/next)** · 1 min read · 11 upvotes · 1 comments ## Summary A critical security issue has been found in an upstream dependency used by Next.js. Vercel plans an out-of-band release of Next.js 16.3.6 and 15.5.26 on September 22, 2026 to fix it. The full advisory, GHSA-vcvr-r3jv-pc5j, will be published alongside the update with impact details, affected versions, and upgrade instructions. Developers are urged to upgrade as soon as the patched versions are available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Next.js versions fix the critical upstream security vulnerability announced for September 22, 2026? Next.js versions 16.3.6 and 15.5.26 fix a critical security issue found in an upstream dependency. These are being released as an out-of-band security update outside the normal release cadence. The full advisory GHSA-vcvr-r3jv-pc5j will be published alongside the release with impact details, affected versions, and upgrade instructions. _daily.dev surfaces urgent framework security releases so teams can patch before exposure lingers._ ### Where can I find the advisory details for the Next.js critical upstream vulnerability fixed in 16.3.6? The advisory is published under the identifier GHSA-vcvr-r3jv-pc5j on the vercel/next.js GitHub security advisories page, released alongside the 16.3.6 and 15.5.26 patches. It includes the impact assessment, list of affected versions, and upgrade instructions once the fix ships. _track critical Next.js advisories on daily.dev to act on upgrade instructions promptly._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > fwiw good that they're giving a heads up before the advisory drops instead of just silently patching. worth pinning your next minor now so the bump doesn't get stuck behind a lockfile review once the CVE details are public. ## Similar posts on daily.dev - [Upcoming Next.js September Security Release](https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c) · Next.js · 19 upvotes · 3 comments - [Upcoming Next.js Security Update for Upstream Vulnerabilities](https://daily.dev/posts/upcoming-next-js-security-update-for-upstream-vulnerabilities-qvzt0fnz7) · Next.js · 3 upvotes · 0 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments - [Upcoming Next.js August Security Release](https://daily.dev/posts/upcoming-next-js-august-security-release-grrtb58k9) · Next.js · 7 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Upcoming Next.js Security Update for a Critical Upstream Issue","url":"https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago"},"datePublished":"2026-09-21T19:51:43.358Z","dateModified":"2026-09-21T19:52:00.110Z","description":"A critical security issue has been found in an upstream dependency used by Next.js. Vercel plans an out-of-band release of Next.js 16.3.6 and 15.5.26 on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab7f9803adf75837e48c6997381a9d2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab7f9803adf75837e48c6997381a9d2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Next.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Next.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a7460ee33d92486cb5afd0fca36a116d","url":"https://daily.dev/sources/next"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,javascript,nextjs,vercel","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Next.js","item":"https://daily.dev/sources/next"},{"@type":"ListItem","position":3,"name":"Upcoming Next.js Security Update for a Critical Upstream Issue"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago","comment":[{"@type":"Comment","text":"fwiw good that they’re giving a heads up before the advisory drops instead of just silently patching. worth pinning your next minor now so the bump doesn’t get stuck behind a lockfile review once the CVE details are public.","datePublished":"2026-09-22T18:14:19.210Z","url":"https://daily.dev/posts/UULTChAGo#c-iSXqsK3gG","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago#faq","mainEntity":[{"@type":"Question","name":"What Next.js versions fix the critical upstream security vulnerability announced for September 22, 2026?","acceptedAnswer":{"@type":"Answer","text":"Next.js versions 16.3.6 and 15.5.26 fix a critical security issue found in an upstream dependency. These are being released as an out-of-band security update outside the normal release cadence. The full advisory GHSA-vcvr-r3jv-pc5j will be published alongside the release with impact details, affected versions, and upgrade instructions. daily.dev surfaces urgent framework security releases so teams can patch before exposure lingers."}},{"@type":"Question","name":"Where can I find the advisory details for the Next.js critical upstream vulnerability fixed in 16.3.6?","acceptedAnswer":{"@type":"Answer","text":"The advisory is published under the identifier GHSA-vcvr-r3jv-pc5j on the vercel/next.js GitHub security advisories page, released alongside the 16.3.6 and 15.5.26 patches. It includes the impact assessment, list of affected versions, and upgrade instructions once the fix ships. track critical Next.js advisories on daily.dev to act on upgrade instructions promptly."}}]} ```