Next.js Implements Monthly Security Advisory Program

Next.js has announced a formal security release program to issue monthly security advisories, starting July 20, 2026. This initiative aims to help users plan updates more effectively, addressing vulnerabilities in versions 15.5 and 16.2. The first advisory will include fixes for four high and five medium severity vulnerabilities. Critical vulnerabilities will still be addressed with immediate ad-hoc patches. The move responds to the rising volume of security research, particularly driven by LLM-assisted discovery. The framework's publisher, Vercel, continues to maintain its bug bounty program to enhance security. This structured approach is intended to reduce disruption caused by unannounced patches. Users are encouraged to stay vigilant and apply updates promptly.

Key Points: • Next.js will issue monthly security advisories starting July 20, 2026. • The first advisory will address multiple vulnerabilities in versions 15.5 and 16.2. • Critical vulnerabilities will still receive immediate ad-hoc patches.