July 20, 2026: The July security release originally targeted for July 20 is now expected on July 21, 2026 .
We invest in security at every stage of the Next.js lifecycle, from static analysis and scanning as code is authored, through auditable package publication, to close collaboration with researchers who responsibly disclose vulnerabilities. The React2Shell exploit disclosed last December is an example of that process working as intended, and we’ve continued to mature our security program since then. As part of that process, today we are formalizing a security release program for Next.js.
The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery: Mozilla recently disclosed 271 issues in a single Firefox release, all surfaced…
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog