Next.js will publish 16.3.3 and 15.5.24 on August 26, 2026, fixing one critical-severity vulnerability.
Only the 16.3 and 15.5 branches are named in the announcement, so anything older needs a minor-version upgrade before it can receive the patch.
The prep work — version audit, branch move, draft bump pull request, named owner — is all doable before the advisory exists.