Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
Publisher
Next.js
Stories with reporting from Next.js: the top stories first, then everything newest first. Each story links to the original articles.
Top stories
Image: Next.js Next.js 16.4
Next.js 16.4 introduces lazy compilation, smaller Turbopack output, React 19.3 features, Cache Components improvements, and new developer tooling.
Next.js 16.3
Next.js 16.3 introduces Instant Navigations, a suite of tools for single-page-app responsiveness, plus a faster dev server, faster builds, and improved tooling for AI agents.
Upcoming Next.js Security Update for a Critical Upstream Issue
Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
Latest
Image: Next.js September 2026 Security Release
Upcoming Next.js September Security Release
Next.js is preparing a scheduled September security release for September 30, 2026.
Next.js Security Update for a Critical Upstream Issue
How we closed 1,500 GitHub issues in one month
How the Next.js team used an agent to research old reports and work through the issue backlog.
How Turbopack chunks your JavaScript
Turbopack’s chunking speeds up page loads and enables sharing code across pages. We shipped new experimental features to improve chunking in Next.js 16.3.
August 2026 Security Release
Update: August Next.js Security Release
Upcoming Next.js August Security Release
Building App-like Experiences with Next.js 16.3
Build app-like experiences with Instant Navigations, server-rendered data, optimistic updates, and live client state in Next.js 16.3.
Making Navigations Instant in v0
The case study behind Instant Navigations in Next.js 16.3, and how we made v0's navigations instant using tests and a coding agent.
July 2026 Security Release
Next.js Security Release and Our Next Patch Release
Turbopack: What's New in Next.js 16.3
Turbopack in Next.js 16.3 adds development memory eviction, persistent file cache for builds, experimental Rust React Compiler, and import.meta.glob support.
Next.js 16.3: AI Improvements
Actionable errors with paste-ready fix prompts, first-party Skills for the dev loop and Cache Components, and tooling that keeps coding agents in sync with your project.
Next.js 16.3: Instant Navigations
A new suite of tools that brings the responsiveness of a single-page app to the server-centric model of Next.js.
Next.js Across Platforms: Adapters, OpenNext, and Our Commitments
Next.js 16.2 introduces a stable Adapter API, a public adapter test suite, and a working group for more consistent deployment across platforms.
