Next.js security release lands August 26. Prep now

Vercel has told everyone that a critical bug exists in Next.js, and has not yet said what it is. The Next.js security release lands on August 26, 2026. It fixes one critical-severity vulnerability, and it ships as version 16.3.3 and version 15.5.24.

That gap between the warning and the patch is deliberate. It is also the most useful window a team gets. The advisory arrives with the fix, so August 26 is the day everyone starts reading. The work that makes that day cheap can be done in the five days before it.

What Vercel actually announced

Next.js is a React framework maintained by Vercel for server-rendered and statically generated web applications. Vercel announced a scheduled security release for August 26, 2026, covering exactly one critical-severity vulnerability, in a pre-announcement post on the Next.js blog.

Four facts are public right now.

Item	What is known
Release date	August 26, 2026
Severity	Critical, one issue
Patched versions	16.3.3 and 15.5.24
Advisory contents	Impact, affected versions, upgrade instructions

Everything else is embargoed. There is no CVE number, no named component and no proof of concept. Vercel's security release program explains the trade: announcing the date lets teams book the window, while withholding the detail stops attackers working backwards to the bug.

Which versions get the patch, and which do not

Only the 16.3 and 15.5 branches are named. Vercel is publishing 16.3.3 and 15.5.24, and nothing in the announcement promises a backport to 15.4, 15.3, 16.0, 16.1 or 16.2.

This is the part most patch-day coverage will skip. A team running Next.js 16.1 does not have a one-line bump ahead of it. It has a minor-version upgrade first, and then a patch. That is a different amount of work, and it needs review time that August 26 will not provide.

Check the installed version first:

npm ls next

Then find your row:

• On 16.3.x or 15.5.x — a patched branch. August 26 is a single dependency bump.
• On 16.0, 16.1 or 16.2 — move to 16.3 this week, using the version 16 upgrade guide.
• On 15.0 through 15.4 — move to 15.5 this week, or plan the larger jump to 16.
• On 14.x or older — outside the patch window entirely. This release will not reach you.

What to prep before August 26

Do the mechanical work now, so patch day is a merge instead of a project. The methodology is simple: separate the parts that need judgement from the part that needs speed, and finish the judgement early.

1. Record the deployed version everywhere. Note the exact next version in production, staging and preview. Environments drift, and the one nobody checks is usually the oldest.
2. Move onto a patched branch. If you are not on 16.3 or 15.5, upgrade to it under normal review this week, not under time pressure next week.
3. Open the bump as a draft pull request now. Set next to 16.3.3 or 15.5.24 and let CI run. It will fail to install today, because the version does not exist yet. The branch, the reviewers and the checks are what you are pre-building.
4. Confirm the deploy path. Self-hosted teams need a container rebuild. Teams on Vercel need a redeploy, not only a dependency change in the repository.
5. Name the owner for the 26th. One person reads the advisory the hour it lands and decides whether the version bump alone closes the issue.

Does a critical rating mean you are being exploited?

No. A critical rating describes the potential impact of the bug. It is not evidence that anyone is using it, and Vercel's announcement makes no claim of exploitation in the wild.

The rating still sets the schedule. Critical severity in a framework that sits at the network edge usually implies unauthenticated impact, and this ecosystem has recent form. The React Server Components vulnerability disclosed in December 2025 and the July 2026 security release both drove same-week patching across large deployments. Plan for same-week, not same-quarter.

What the advisory will and will not tell you

The August 26 advisory will state the impact, the affected version ranges and the upgrade instructions, which is what Vercel committed to publishing alongside the release. It will not tell you whether your own application was reachable.

That check is yours, and it is faster if you do the indexing now. When the advisory names an affected component — middleware, image optimization, the router, or server actions, for example — you will want an immediate answer on whether your codebase touches it.

Grep for the four usual suspects this week and keep the output:

rg -l "middleware\.(ts|js)" .
rg -l "next/image" app components
rg -l "use server" app
rg -l "unstable_cache|revalidateTag" .

Should you upgrade now, wait, or ignore it?

Upgrade to a patched branch now, then apply the patch on August 26. That is the answer for essentially every internet-facing deployment.

Ignoring it is defensible in exactly one case: the application is not internet-facing and never handles untrusted input, such as an internal dashboard behind a VPN. Even then, the version drift you accumulate makes the next critical release more expensive, not less.

Waiting for the CVE number is not a strategy. The number explains what the bug was. It does not change which branch you must be on to receive the fix, and that is the only part of this with a deadline.

The build problem that is not a security problem

One issue confuses this window for some teams. A Turbopack build failing in Next.js 16.3 blocks the upgrade path, and a blocked upgrade path means the security patch cannot land. That is a build problem, and it has to be cleared first. Fix the build, then queue the security bump behind it.

Runtime drift causes the same jam. Node.js 26 turns Temporal on by default, and stacking a runtime upgrade on top of a framework patch in one sprint is how a two-line change becomes a bad week. Sequence them, and keep the security bump on its own.