The developers of Next.js, a framework for web applications, plan to release out-of-band versions 16.3.6 and 15.5.26 on September 22 because of a critical issue in an upstream dependency. The full advisory GHSA-vcvr-r3jv-pc5j will be released with the update and will cover impact, affected versions, and upgrade instructions.
The developers advise updating to Next.js 16.3.6 or 15.5.26 as soon as they become available.
Claim check:
- The developers of Next.js plan to release out-of-band versions 16.3.6 and 15.5.26 on September 22 because of a critical issue in an upstream dependency. (confirmed by the publication itself: evidence; «A critical security issue has been identified in an upstream dependency. We plan to publish Next.js 16.3.6 and 15.5.26 in an out-of-band update on September 22, 2026 .»)
- The full advisory GHSA-vcvr-r3jv-pc5j will be released with the update and will cover impact, affected versions, and upgrade instructions. (confirmed by the publication itself: evidence; «The full advisory, GHSA-vcvr-r3jv-pc5j , will be published with the update and include impact, affected versions, and upgrade instructions.»)
- The developers advise updating to Next.js 16.3.6 or 15.5.26 as soon as they become available. (confirmed by the publication itself: evidence; «Upgrade to Next.js 16.3.6 or 15.5.26 as soon as they are available.»)
Primary sources:
score 60.2 out of 100 · kind: event