--- title: Upcoming Next.js September Security Release | daily.dev description: Next.js is preparing a scheduled security release for September 30, 2026, covering nine vulnerabilities: one critical, two high, five medium, and one low.... canonical: https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Upcoming Next.js September Security Release | daily.dev og:description: Next.js is preparing a scheduled security release for September 30, 2026, covering nine vulnerabilities: one critical, two high, five medium, and one low.... og:url: https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c og:image: https://api.daily.dev/og/posts/wyCFL3t7C.png og:image:alt: Upcoming Next.js September Security Release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Upcoming Next.js September Security Release **[Next.js](https://daily.dev/sources/next)** · 1 min read · 19 upvotes · 3 comments ## Summary Next.js is preparing a scheduled security release for September 30, 2026, covering nine vulnerabilities: one critical, two high, five medium, and one low. Patched versions 16.3.7 and 15.5.27 will be published alongside full advisories detailing impact, affected versions, and upgrade instructions. Teams are advised to plan to upgrade once the release lands. The security work stems from Vercel's Open Source Bug Bounty program with external researchers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When is the Next.js September 2026 security release and what versions will it patch? The Next.js security release is scheduled for September 30, 2026, addressing nine vulnerabilities: one critical, two high, five medium, and one low severity. Patched versions 16.3.7 and 15.5.27 will be published alongside full advisories covering impact, affected versions, and upgrade instructions. Teams should plan to upgrade once the release becomes available. _daily.dev helps teams track scheduled framework security releases so upgrades aren't left until the last minute._ ### How many vulnerabilities does the Next.js 16.3.7 and 15.5.27 security release fix? The release fixes nine vulnerabilities total: one critical, two high, five medium, and one low severity issue. Full advisories with impact details, affected versions, and upgrade instructions will be published alongside the patched releases, 16.3.7 and 15.5.27, on September 30, 2026. _Following severity breakdowns like this on daily.dev helps prioritize which Next.js upgrades to schedule first._ ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 3 upvotes > yeah at least this 1 is on schedule lol **@agustinbarrientos** · 2 upvotes > The upgrade ticket should name every deployed Next.js app, including previews that are still reachable. I'd give each one an owner before patch day. **@ristotoldsep** · 0 upvotes > Scheduled security releases are boring in exactly the right way. Thanks for the heads-up. ## Similar posts on daily.dev - [Upcoming Next.js August Security Release](https://daily.dev/posts/upcoming-next-js-august-security-release-grrtb58k9) · Next.js · 7 upvotes · 0 comments - [Upcoming Next.js Security Update for a Critical Upstream Issue](https://daily.dev/posts/upcoming-next-js-security-update-for-a-critical-upstream-issue-uultchago) · Next.js · 11 upvotes · 1 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments - [Upcoming Next.js Security Update for Upstream Vulnerabilities](https://daily.dev/posts/upcoming-next-js-security-update-for-upstream-vulnerabilities-qvzt0fnz7) · Next.js · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Upcoming Next.js September Security Release","url":"https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c"},"datePublished":"2026-09-23T22:30:14.007Z","dateModified":"2026-09-23T22:30:31.888Z","description":"Next.js is preparing a scheduled security release for September 30, 2026, covering nine vulnerabilities: one critical, two high, five medium, and one low....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9870fa3bbd208da338e7f0a6d68babc6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9870fa3bbd208da338e7f0a6d68babc6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Next.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Next.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a7460ee33d92486cb5afd0fca36a116d","url":"https://daily.dev/sources/next"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":19},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"security,nextjs,vercel","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Next.js","item":"https://daily.dev/sources/next"},{"@type":"ListItem","position":3,"name":"Upcoming Next.js September Security Release"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c","comment":[{"@type":"Comment","text":"yeah at least this 1 is on schedule lol","datePublished":"2026-09-24T12:54:27.752Z","url":"https://daily.dev/posts/wyCFL3t7C#c-JP8KbOvUG","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"The upgrade ticket should name every deployed Next.js app, including previews that are still reachable. I’d give each one an owner before patch day.","datePublished":"2026-09-24T21:23:23.682Z","url":"https://daily.dev/posts/wyCFL3t7C#c-uFmPabYUw","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Scheduled security releases are boring in exactly the right way. Thanks for the heads-up.","datePublished":"2026-09-29T10:36:38.587Z","url":"https://daily.dev/posts/wyCFL3t7C#c-RFX2Npanj","author":{"@type":"Person","name":"Risto Tõldsep","url":"https://daily.dev/ristotoldsep","image":"https://lh3.googleusercontent.com/a/ACg8ocLDWc6mZn0JwNmXXw6WY0L_HJ6pegzRttooC5VgtXESHSj3MNYx=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/upcoming-next-js-september-security-release-wycfl3t7c#faq","mainEntity":[{"@type":"Question","name":"When is the Next.js September 2026 security release and what versions will it patch?","acceptedAnswer":{"@type":"Answer","text":"The Next.js security release is scheduled for September 30, 2026, addressing nine vulnerabilities: one critical, two high, five medium, and one low severity. Patched versions 16.3.7 and 15.5.27 will be published alongside full advisories covering impact, affected versions, and upgrade instructions. Teams should plan to upgrade once the release becomes available. daily.dev helps teams track scheduled framework security releases so upgrades aren't left until the last minute."}},{"@type":"Question","name":"How many vulnerabilities does the Next.js 16.3.7 and 15.5.27 security release fix?","acceptedAnswer":{"@type":"Answer","text":"The release fixes nine vulnerabilities total: one critical, two high, five medium, and one low severity issue. Full advisories with impact details, affected versions, and upgrade instructions will be published alongside the patched releases, 16.3.7 and 15.5.27, on September 30, 2026. Following severity breakdowns like this on daily.dev helps prioritize which Next.js upgrades to schedule first."}}]} ```