Next.js will patch one critical vulnerability on August 26

Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 arrive on August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.

Next.js announced a scheduled security release for August 26, 2026, six days before it ships. The release addresses one vulnerability rated critical, and it will arrive as versions 16.3.3 and 15.5.24 together with the advisory describing impact, affected versions, and upgrade steps. What is known before the release The post states the severity and the version numbers and nothing about the vulnerability itself. That is the point of the format: the details arrive with the patch, so the announcement gives you a date to plan around without handing anyone a map. Two release lines get the fix. If you are on the 16.x line you upgrade to 16.3.3, and if you are still on 15.x you upgrade to 15.5.24. There is no indication that either line is affected differently. Why the notice comes first Next.js announced this process in July. The reasoning is scheduling: a critical patch that lands without warning competes with whatever a team already had planned that day, and the upgrade slips. A date known six days in advance turns the same work into a calendar entry. The tradeoff is public. Announcing that a critical vulnerability exists, before the patch does, tells attackers where to look. Vercel accepts that cost in exchange for a shorter gap between the patch and its deployment, and the announcement carries no technical detail to shorten anyone's search. The release date is August 26, 2026. One vulnerability, rated critical. Patched versions: 16.3.3 on the 16.x line, 15.5.24 on the 15.x line. The advisory with impact and affected versions is published with the release, not before. What to do before then Find out which Next.js version each of your deployments actually runs, not which one the lockfile claims. Confirm that your upgrade path from that version to the patched one is clean, because a version jump you have been postponing turns a five-minute security upgrade into an afternoon. The post lists security@vercel.com for questions and points researchers to Vercel's Open Source Bug Bounty. It is signed by Josh Story, Karim Rahal, and Sebastian Silbermann.