Next.js security releases now ship on a schedule

Next.js security releases used to arrive the way weather does: unannounced, occasionally severe, always on a day you had other plans. Vercel changed that. The framework now publishes advance notice of security patches roughly once a month, with the expected date and the highest anticipated severity stated up front. The first scheduled batch shipped July 20 and it was not small — nine CVEs, four of them high severity.

What actually happened

Per the Next.js blog, fixes landed in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS), plus the 16.3 canary and preview channels. The high-severity set is worth reading closely if you run App Router:

• CVE-2026-64641 — crafted requests against an app with at least one Server Action cause runaway CPU, blocking every other request in the process. Denial of service.
• CVE-2026-64642 — apps built with Turbopack and a single entry in config.i18n.locales can have middleware bypassed entirely. Any auth check living in middleware is skipped.
• CVE-2026-64645 — a rewrites() or redirects() rule that builds its destination hostname from request input can be pointed anywhere. SSRF on rewrites, open redirect on redirects.
• CVE-2026-64649 — SSRF via Server Actions on custom servers when an attacker controls Host-associated headers.

The medium set covers image-optimization CPU exhaustion via malicious SVGs, unbounded Server Action payloads on the Edge runtime, disclosure of internal Server Function endpoint IDs, and two flavors of fetch cache confusion where a request body returns another request's cached response.

The process change came four days earlier. As Socket documented, Vercel described its prior cadence as "infrequent and disruptive, arriving with no advance warning," and now commits to monthly preannouncements with severity signalled ahead of time. Actively exploited bugs still ship out-of-band — the schedule is a floor, not a ceiling.

Why a predictable patch window matters for your business

The middleware bypass is the one to sit with. A lot of small-team Next.js apps put their auth gate in middleware.ts because that's what the docs suggest and it's one file. Under CVE-2026-64642, a specific and entirely ordinary config — Turbopack, one locale — makes that gate optional for an attacker. If middleware is your only authorization layer, a framework bug is a full authentication bypass. Check permissions at the data-access boundary too, in the Server Action or route handler that actually touches the record.

The scheduling change matters for a different reason. We've written about Adobe halving its patch window and Dependabot's three-day cooldown — the industry is converging on predictable cadence, and predictable cadence is something a two-person team can actually staff. An unannounced high-severity CVE means someone drops what they're doing. A date on the calendar means a two-hour block, a staging deploy, and a smoke test.

The practical setup, if you run Next.js in production: pin to an LTS line, subscribe to the Next.js blog feed, put the monthly window on the calendar as recurring work, and keep a staging environment that gets the patch first. Nine CVEs in one release is exactly the volume that makes "we'll upgrade when we get to it" turn into a version four minors behind with a migration guide attached.

Sources: Next.js July 2026 Security Release, Socket.