Next.js will patch one critical vulnerability on August 26
Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 arrive on August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.
Next.js announced a scheduled security release for August 26, 2026, six days before it ships. The release addresses one vulnerability rated critical, and it will arrive as versions 16.3.3 and 15.5.24 together with the advisory describing impact, affected versions, and upgrade steps.
What is known before the release
The post states the severity and the version numbers and nothing about the vulnerability itself. That is the point of the format: the details arrive with the patch, so the announcement gives you a date to plan around without handing anyone a map.
Two release lines get the fix. If you are on the 16.x line you upgrade to 16.3.3, and if you are still on 15.x you upgrade to 15.5.24. There is no indication that either line is affected differently.
Why the notice comes first
Next.js announced this process in July. The reasoning is scheduling: a critical patch that lands without warning competes with whatever a team already had planned that day, and the upgrade slips. A date known six days in advance turns the same work into a calendar entry.
The tradeoff is public. Announcing that a critical vulnerability exists, before the patch does, tells attackers where to look. Vercel accepts that cost in exchange for a shorter gap between the patch and its deployment, and the announcement carries no technical detail to shorten anyone's search.
- The release date is August 26, 2026.
- One vulnerability, rated critical.
- Patched versions: 16.3.3 on the 16.x line, 15.5.24 on the 15.x line.
- The advisory with impact and affected versions is published with the release, not before.
What to do before then
Find out which Next.js version each of your deployments actually runs, not which one the lockfile claims. Confirm that your upgrade path from that version to the patched one is clean, because a version jump you have been postponing turns a five-minute security upgrade into an afternoon.
The post lists security@vercel.com for questions and points researchers to Vercel's Open Source Bug Bounty. It is signed by Josh Story, Karim Rahal, and Sebastian Silbermann.
„This advance notice gives teams time to plan upgrades before patches are published.“
Related
llm 0.33 takes the pin out and moves to httpx2
Version 0.32.1 held fresh installs together by pinning the OpenAI Python package below 3.0.0. That was a holding action, and 0.33 does the actual repair: it upgrades to the OpenAI library 3.x and switches its HTTP client from httpx to httpx2. The release also carries changes you will notice in daily use, including a --key option on the embedding commands and server-side tool results that finally show up in llm logs.
Simon Willisonverified
A fresh install of llm broke because the OpenAI library stopped using httpx
Version 0.32.1 pins the OpenAI Python package below 3.0.0 so that new installations work again. Nothing in llm changed to cause the break: it imported httpx while relying on the OpenAI package to bring it along, and when that package dropped httpx the dependency simply stopped arriving. It is a small release with a lesson that outlives it.
Simon Willisonverified
ChatGPT search switched en masse to the site: operator
On August 20, Simon Willison relayed a measurement from Promptwatch showing that ChatGPT abruptly began narrowing its searches to preselected domains. The share of queries carrying the site: operator held between 0.3% and 0.5% for weeks, then jumped to 16% to 17% on August 8 — two days after OpenAI announced accuracy fixes in GPT-5.6. Willison concludes that the search tool internally has the shape search(query, recency, domains), which means the model picks domains before it even frames the question. If you care about visibility in that search, you are no longer competing only for a place in the result but for your domain to make the list the model assembles on its own.
Simon Willisonverified