Next.js will ship out-of-band patches on September 22 for a critical upstream flaw

The Next.js team published a warning rather than a fix. A post dated September 21, 2026 reports a critical flaw in a package the framework depends on, and promises two patched releases in an out-of-band update on September 22, 2026. Two branches are named: 16.x gets 16.3.6, and 15.x gets 15.5.26.

What the notice says

Vercel's security team gave the release date, the version numbers and the advisory identifier, and stopped there. The identifier is GHSA-vcvr-r3jv-pc5j, and the post states that impact, affected versions and upgrade instructions all arrive with the update itself. Josh Story, Karim Rahal and Sebastian Silbermann are named as the authors.

The package holding the flaw is not named anywhere in the post. That is the ordinary shape of a coordinated disclosure: the maintainers of the upstream package publish first, and every framework that wraps it holds its own details back until that moment. The consequence is that anyone reading the notice on September 21, 2026 learns that something serious is coming without learning what it touches.

Why an upstream flaw reaches applications built on the framework

A framework is a tree of dependencies. Next.js pulls in code it did not write for image handling, compression and routing internals, among other things. When a flaw sits in one of those packages, every application built on the framework inherits it, whether or not that application ever calls the vulnerable path itself.

The same inheritance explains why the framework, rather than the package, publishes the fix a build actually consumes. Bumping the transitive dependency by hand is rarely enough, because the framework pins the ranges its own dependencies resolve within.

What is worth doing before the release lands

The gap between a pre-announcement and a patch is the one stretch where an attacker may know a flaw exists and defenders do not know what it is. Vercel held that gap to roughly one day, which is short. It is still long enough that the useful work is preparation rather than analysis.

Checked on the morning of September 22, 2026, neither release had reached the npm registry, so there are no upgrade instructions to follow yet.

• Establish which framework version every deployment runs, preview and staging environments included.
• Follow the releases page and the advisory identifier rather than reposts on social platforms.
• Settle in advance who approves an unplanned production deploy, so that call is not made while the advisory is being read.