From Next.js Blog
Fri, October 9
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
Wed, September 23
Next.js Security Update for a Critical Upstream Issue
The September 22, 2026 out-of-band security update for Next.js is now available
Upcoming Next.js Security Update for a Critical Upstream Issue
Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
Thu, December 4
Security Advisory: CVE-2025-66478
A critical vulnerability (CVE-2025-66478) has been identified in the React Server Components protocol. Users should upgrade to patched versions immediately.