October's Next.js Security Patch: Check Now, Not Tomorrow
By Arash Latifi
Next.js announced an out-of-band security update for October 14, 2026: two Critical and one High vulnerabilities in upstream dependencies. What the summer's release pattern tells you — and what to do right now.
TL;DR — Today (October 14, 2026) is the announced date for Next.js's out-of-band security update: two Critical and one High vulnerabilities in upstream dependencies. First thing: check whether the patch is live, and if so, upgrade today.
In the 16.3.8 patch guide I covered Vercel's new monthly security rhythm. This week is its first real stress test — and a good moment to tighten your own patching routine.
What's happening
On October 8 the Next.js team announced an out-of-band security update for Wednesday, October 14, 2026, addressing three vulnerabilities in upstream dependencies: two Critical and one High. Two of the fixes were postponed from the September release due to upstream coordination. Full advisories — CVEs, affected versions, and upgrade instructions — ship with the update itself.
Key detail: "upstream" means the flaw isn't in Next.js's own code but in packages Next.js vendors. Since Next.js bundles them, the fix still comes through a Next.js update — not by patching those packages yourself.
The summer pattern: what to expect
Three previous rounds set a clear rhythm:
| Release | Date | Summary | |---|---|---| | July 2026 | Jul 30 | First formal monthly release | | August 2026 | Aug 25 (moved up from 26) | Monthly round | | September 2026 | Sep 22 & 30 | Out-of-band critical ImageResponse RCE fix + monthly round; two fixes deferred to October |
September's patch versions were 16.3.8 and 15.5.27. Upstream coordination pushed two issues to October — the ones publishing today, this time rated Critical.
Do this now
- [ ] Check your
nextversion (npm ls next) — if you're on 16.3.8 or 15.5.27, your baseline is ready - [ ] Check the Next.js blog and GitHub releases: is today's patch out? What's the new version number?
- [ ] If it's out: upgrade on a branch, run
npm run build, and smoke-test key pages (ISR, OG images, main routes) - [ ] If it's not out yet: bookmark the Next.js blog / GitHub releases and check again tomorrow morning
- [ ] For business-critical apps on 16.4, set
experimental.agentUpgrade: 'security'so relevant security upgrades get flagged automatically
Note for self-hosted deployments: recent patches show self-hosted scenarios (like ISR cache poisoning) are taken seriously; being on Vercel isn't a reason to wait, since some vectors apply across platforms.
FAQ
Q: My project isn't commercial — still urgent?
A plain landing page with no user data is lower risk, but the update takes five minutes — do it on the next quiet morning. The announcement rates two issues Critical, and until the advisories publish you can't judge how practical the attack scenarios are; that ambiguity alone justifies patching fast.
Q: How do I know if my version is affected?
Affected versions ship in the advisories with the patch. Until then, if you're not on the latest current LTS patch (16.3.8 or 15.5.27), assume you're exposed and update.
Q: I'm afraid the update breaks something — what's the protocol?
Same as always: separate branch, upgrade, full build, smoke-test key pages, then merge. The two previous patch rounds didn't produce widespread breaking-change reports — security patches are typically small and targeted.