Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Next.js plans Sept 22 out-of-band security release (16.3.6 / 15.5.26)
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Optional further reading — not required for grades.
Next.js announced an upcoming out-of-band security update for a critical issue identified in an upstream dependency. The team plans to publish Next.js 16.3.6 and 15.5.26 on September 22, 2026. The full advisory GHSA-vcvr-r3jv-pc5j will publish with the update and will cover impact, affected versions, and upgrade instructions.
Upgrade to 16.3.6 or 15.5.26 as soon as those releases are available. For questions about the Vercel Open Source Bug Bounty program, the post points to security@vercel.com.
Optional further reading for CS 4550 / CS 5610 — not required for labs or grades. Chapters 1 and 5 already stress keeping framework and dependency versions current; treat this digest as patch hygiene context, not a lab requirement. Follow the original Next.js post and the advisory when it publishes for affected versions and upgrade steps.
Read original: Upcoming Next.js Security Update for a Critical Upstream Issue — Next.js