Skip to content
What are you looking for?. Open searchSR
Toolsmedium signalverified

Next.js schedules a September 30 security release that fixes nine vulnerabilities

The Next.js team announced on September 23, 2026 that versions 16.3.7 and 15.5.27 will ship on September 30, 2026. The release addresses nine vulnerabilities, one of them rated critical. The advisories that describe them appear only with the release. It follows the out-of-band 16.3.6 by eight days, so many projects will upgrade twice in the same month.

By Redakcija WebAiRadarPublished 2 min readwritten by a model

Source

Upcoming Next.js September Security Release

Next.js Blog · Original published September 23, 2026

Next.js published an advance notice rather than a patch. The post, dated September 23, 2026, schedules a security release for September 30, 2026 and names two versions: 16.3.7 for the 16.x line and 15.5.27 for the 15.x line. The stated purpose is to give teams time to plan the upgrade.

What the notice says

The release will address nine vulnerabilities: one critical, two high, five medium, and one low. Full advisories, with impact, affected versions, and upgrade instructions, will be published alongside the versions. Until then, the notice gives no detail about any of the flaws, and it names no release for the 14.x line.

Josh Story, Karim Rahal, and Sebastian Silbermann are listed as the authors. The post points researchers to Vercel's Open Source Bug Bounty and gives security@vercel.com for questions.

The second security release in eight days

On September 22, 2026, Next.js shipped 16.3.6 and 15.5.26 out of band. Version 16.3.6 closes a critical remote code execution flaw in the Node.js ImageResponse implementation in next/og, which affects versions from 16.2.0. The 15.x line was not affected by that flaw, and 15.5.26 adds hardening only. Checked on the morning of September 24, 2026, neither 16.3.7 nor 15.5.27 was on npm yet.

The practical consequence is two upgrades in one month for anyone who applied the first patch. A project that skipped 16.3.6 should not wait for September 30, because the critical flaw it fixes is already public.

What is worth doing before September 30

A scheduled release with a known date allows preparation that an emergency patch does not.

  • Confirm that every deployment on the 16.x line already runs 16.3.6.
  • Reserve time on September 30 for the upgrade and a production deploy.
  • Check whether any project still runs the 14.x line, since the notice announces nothing for it.
  • Follow the advisories on the release page rather than summaries on social platforms.
„This advance notice gives teams time to plan upgrades before patches are published.“
Next.js security notice, September 23, 2026

Sources

TagssecurityNext.jsJavaScriptdependencies

Related

PYTHON3.15UTF-8 by default and lazy imports
Toolsmedium signal

Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports

Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.

Python Software Foundationverified

An archival index card with a typed caption and a black-and-white photograph of workers on a ship's deck handling a buoy and its anchor chain, laid over beige graph paper and a red table of figures.
Toolsmedium signal

Anthropic's OSS Scanner sends open-source maintainers free vulnerability reports that no human has reviewed

Anthropic launched OSS Scanner on October 8, 2026, an opt-in service that scans eligible open-source projects with its strongest models, including Claude Mythos, at no cost. Each report includes a reproducer, an explanation, and a candidate patch when one exists, but no person checks it before it is sent. Anthropic says it expects more than 90% of findings to be real.

Anthropicverified