Next.js announced its security release six days ahead, with one critical vulnerability
Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 were announced for August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.
Next.js announced a scheduled security release for August 26, 2026, six days before it was due to ship. The announcement named one vulnerability rated critical, and said the fix would arrive as versions 16.3.3 and 15.5.24 together with the advisory describing impact, affected versions, and upgrade steps.
What is known before the release
The post states the severity and the version numbers and nothing about the vulnerability itself. That is the point of the format: the details arrive with the patch, so the announcement gives you a date to plan around without handing anyone a map.
Two release lines get the fix. If you are on the 16.x line you upgrade to 16.3.3, and if you are still on 15.x you upgrade to 15.5.24. There is no indication that either line is affected differently.
Why the notice comes first
Next.js announced this process in July. The reasoning is scheduling: a critical patch that lands without warning competes with whatever a team already had planned that day, and the upgrade slips. A date known six days in advance turns the same work into a calendar entry.
The tradeoff is public. Announcing that a critical vulnerability exists, before the patch does, tells attackers where to look. Vercel accepts that cost in exchange for a shorter gap between the patch and its deployment, and the announcement carries no technical detail to shorten anyone's search.
- The release date is August 26, 2026.
- One vulnerability, rated critical.
- Patched versions: 16.3.3 on the 16.x line, 15.5.24 on the 15.x line.
- The advisory with impact and affected versions is published with the release, not before.
What to do before then
Find out which Next.js version each of your deployments actually runs, not which one the lockfile claims. Confirm that your upgrade path from that version to the patched one is clean, because a version jump you have been postponing turns a five-minute security upgrade into an afternoon.
The post lists security@vercel.com for questions and points researchers to Vercel's Open Source Bug Bounty. It is signed by Josh Story, Karim Rahal, and Sebastian Silbermann.
„This advance notice gives teams time to plan upgrades before patches are published.“
Sources
Corrections
An earlier version said the security release arrives on August 26, 2026 and closes one critical vulnerability, following the announcement of August 20. On August 25 Vercel said it had found a second critical vulnerability in an upstream dependency and was moving the release a day earlier because of it. This item remains the record of the announcement; what actually shipped, versions 16.3.3 and 15.5.24 on August 25 with two critical vulnerabilities, is in the linked item.
Related
Next.js moved its patch a day early, and the count went from one critical hole to two
Versions 16.3.3 and 15.5.24 shipped on August 25 instead of the announced August 26. A second unauthenticated remote code execution had turned up in an upstream library, and the patched releases switch AVIF image optimization off until that library is fixed.
Next.jsverified
Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports
Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.
Python Software Foundationverified
Deno's team joins Cloudflare, and the Deno runtime gets one more year of updates
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified