Next.js has announced an upcoming out-of-band security update. For teams operating an application, two questions follow: can we upgrade promptly when it arrives, and does our configuration fall within the affected scope?

Those questions need different information. Upgrade preparation can begin now, while vulnerability applicability needs to be checked against the formal affected-version and configuration details.

Using the advance notice available on September 22, 2026, we can identify the planned updates for the 16.x and 15.x lines and gather the environment information needed to act on the advisory.

The Next.js update is planned outside the regular release schedule

The official announcement dated September 21, 2026 identifies a critical security issue in an upstream dependency. Next.js 16.3.6 and 15.5.26 are planned for September 22, 2026, with instructions to upgrade promptly once they become available.

For context, Next.js introduced its security release program on July 13, 2026. It provides roughly monthly advance notices with expected timing and the highest anticipated severity, while retaining ad-hoc patches for urgent disclosures or vulnerabilities already being exploited.

An out-of-band release does not, by itself, establish that this particular issue is being exploited. The notice identifies an upstream dependency issue but does not name the dependency or describe attack conditions.

The full advisory, GHSA-vcvr-r3jv-pc5j, is scheduled to accompany the update with impact, affected versions, and upgrade instructions. Its contents could not be retrieved during research on September 22, 2026, so this article treats the update as an advance announcement.

Match the 16.x and 15.x update paths to deployed versions

The Next.js support policy explains the context for the two release lines. At the time of checking, 16.x is Active LTS and 15.x is Maintenance LTS. Maintenance LTS still receives critical bug fixes and essential security updates.

The announcement therefore includes an update path for 15.x. Teams running that line can prepare for 15.5.26 while awaiting the formal instructions; the notice does not establish a requirement to migrate to 16.x as part of this response.

However, 16.3.6 and 15.5.26 are planned patched versions, not an affected-version range. Those numbers alone do not establish that every earlier version is vulnerable or that 14.x is unaffected. Support status and applicability to a specific vulnerability are separate determinations.

Gather environment details before turning the advisory into an upgrade

Start by identifying the Next.js version used by each production application. From a project root where dependencies are already installed, run:

npx next info

The official next info reference documents output including the operating system, runtime tools such as Node.js, and versions of next, react, and react-dom. It describes the environment where the command runs, so associate the record with the deployed commit and lockfile before using it to assess production.

As an operational preparation, identify the person handling the upgrade and the environment used for validation. Once the patch is available, use the advisory to establish applicability and the required upgrade steps, then update dependencies, run existing tests and a production build, and redeploy.

The official production guide recommends next build followed by next start for local production-like testing. For a conventional Next.js server deployment, this provides a way to exercise key pages and APIs after building. It checks compatibility; a successful build alone does not establish that the security response is complete.

The useful work before disclosure is to shorten the path from receiving the advisory to making a deployment decision. With deployed versions and validation steps already recorded, teams can assess applicability when the details arrive and move promptly to the required update.

Source

• Title: Upcoming Next.js Security Update for a Critical Upstream Issue
• URL: https://nextjs.org/blog/upcoming-nextjs-security-release-september-22-2026