Upcoming Next.js September Security Release

September 30, 2026: This release now addresses seven vulnerabilities instead of nine. The remaining two (one critical , one high ) are pending upstream coordination and will be addressed in a later Next.js release.

September 29, 2026: Next.js 16.3.7 was published with a bug fix. It does not include the security fixes planned for September 30. We now expect those fixes in 16.3.8 and 15.5.27 .