Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Next.js plans Sept 22 out-of-band security release (16.3.6 / 15.5.26)
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
Next.js announced an upcoming out-of-band security update for a critical issue identified in an upstream dependency. The team plans to publish Next.js 16.3.6 and 15.5.26 on September 22, 2026. The full advisory GHSA-vcvr-r3jv-pc5j will publish with the update and will cover impact, affected versions, and upgrade instructions.
Upgrade to 16.3.6 or 15.5.26 as soon as those releases are available. For questions about the Vercel Open Source Bug Bounty program, the post points to security@vercel.com.
That upgrade is the same framework and dependency hygiene as Chapter 1 and the Node packages in Chapter 5; follow the original Next.js post and the advisory when it publishes for affected versions and upgrade steps.
Read original: Upcoming Next.js Security Update for a Critical Upstream Issue — Next.js