Next.js Starts Regular Security Release Program, With 9 Fixes Due July 20

Next.js has introduced a formal security release program that will give developers advance notice of planned security updates. Its first scheduled release targets July 20, 2026, with fixes for nine vulnerabilities across two supported release lines.

According to the Next.js security release announcement, the update will include patches for four high-severity and five medium-severity vulnerabilities. The fixes will arrive through patch releases for Next.js 16.2 and 15.5.

The Next.js team has not yet published CVE identifiers, technical descriptions or exact patched version numbers. It plans to disclose those details when the security updates become available.

What the July Next.js Security Release Includes

Release detail	Current information
Target publication date	July 20, 2026
Affected release lines	Next.js 16.2 and 15.5
High-severity fixes	4
Medium-severity fixes	5
Total vulnerabilities	9
CVE identifiers	To be published with the patches
Confirmed active exploitation	Not announced

Next.js 16.x currently holds Active Long-Term Support status, while Next.js 15.x remains in Maintenance LTS. The framework’s support policy says Active LTS releases receive features, bug fixes, performance improvements and security patches.

Maintenance LTS versions receive essential security updates and critical bug fixes. Next.js generally maintains the previous major release in this phase for two years after its initial publication.

Versions 14.x and earlier fall outside the current LTS policy. The team may occasionally patch unsupported releases when a vulnerability’s severity justifies it, but developers should not rely on such exceptions.

Advance Notices Will Arrive Roughly Once a Month

Next.js previously published security patches when fixes became ready, without providing advance notice. Although these updates occurred infrequently, their timing could disrupt development teams and production deployments.

Under the new program, Next.js plans to publish an advance notice roughly once a month. Each notice will provide an expected release schedule and identify the highest anticipated severity among the included vulnerabilities.

This does not necessarily mean Next.js will release security patches every month. The monthly cadence applies to advance announcements for upcoming scheduled releases when the team has fixes to publish.

• Advance notices will appear on the Next.js blog.
• Each notice will include an expected patch timeline.
• Next.js will disclose the highest anticipated severity.
• Technical details will remain private until patches become available.
• Urgent vulnerabilities can still receive immediate updates outside the schedule.

Emergency Security Patches Will Continue

Next.js will not delay fixes that require immediate action. The team says it will continue publishing unscheduled patches when a vulnerability faces active exploitation or cannot safely wait for the next planned release.

This creates two separate security update paths. Scheduled releases will cover vulnerabilities that can remain private while teams prepare patches and mitigations. Emergency releases will address urgent threats that expose users to immediate risk.

The formal schedule should also help cloud platforms, hosting companies and other ecosystem partners prepare temporary protections. These measures could include firewall rules that reduce exposure while application owners test and deploy the corrected Next.js versions.

AI Tools Are Finding More Vulnerabilities

Next.js linked the new process to a broader increase in vulnerability research driven by large language models. Vercel uses DeepSec, internal security researchers and an expanded bug bounty program to find flaws before attackers do.

DeepSec is an open-source, agent-powered security harness designed to examine large codebases. It first identifies candidate areas using matchers and then uses coding agents to investigate the code, produce findings and recommend changes.

The tool can distribute large scans across multiple workers and revalidate findings to reduce false positives. However, its documentation warns that extensive scans can cost thousands or tens of thousands of dollars, depending on the codebase and selected models.

Next.js also cited Mozilla’s AI-assisted Firefox research. Mozilla reported that an early version of Anthropic’s Claude Mythos Preview identified 271 vulnerabilities fixed in Firefox 150.

Security Research Is Becoming Faster

AI-assisted analysis can inspect more code than a small security team could review manually. This may help maintainers find vulnerabilities that remained unnoticed for years, especially in large and mature projects.

The volume also creates operational pressure. Maintainers must reproduce findings, separate valid reports from false positives, develop patches and coordinate disclosures before technical details reach potential attackers.

Mozilla said its security team had to reprioritize work after the Mythos Preview evaluation produced hundreds of findings. The Next.js release program aims to make a similar increase in research volume easier for developers and platform partners to manage.

The DeepSec documentation also makes clear that coding agents need controlled environments and careful validation. The tool can receive shell access inside its environment, so organizations must account for source code exposure, credentials and prompt injection risks.

What Next.js Developers Should Do Now

Teams running Next.js 16.2 or 15.5 should identify their exact installed versions and prepare an expedited upgrade process. They should also confirm which applications use self-hosted deployments and which rely on managed hosting platforms.

Developers should wait for the July 20 advisory before attempting to assess the nine vulnerabilities individually. Until Next.js publishes the CVEs and affected configurations, organizations cannot reliably determine whether a particular application exposes a vulnerable feature.

Security teams can still prepare their testing and deployment workflows in advance. The goal should involve applying the patch quickly without introducing avoidable production failures.

1. Record the Next.js version used by each application.
2. Confirm whether the application runs on the 16.2 or 15.5 release line.
3. Review dependency lock files and automated update controls.
4. Prepare staging environments for the security update.
5. Check whether hosting providers announce temporary mitigations.
6. Read the July 20 advisory for CVEs and affected configurations.
7. Deploy the patched release after completing focused regression tests.

Supported Versions Should Remain the Priority

The Next.js LTS policy lists version 16.x as Active LTS and version 15.x as Maintenance LTS. Organizations using older releases should plan a supported upgrade instead of expecting every security fix to receive a backport.

The July security update will provide an early test of the new disclosure model. Its success will depend on whether Next.js gives developers enough information to prioritize risk while allowing hosting providers and application owners to deploy protection before technical details encourage exploitation.

Developers should monitor the official Next.js announcement and the project blog on July 20. The final advisory should include patched versions, CVE identifiers, vulnerability descriptions and upgrade instructions.

FAQ