Next.js Now Warns You a Patch Is Coming Before It Says Why

Vercel now tells Next.js developers a security patch is coming before it tells them what the patch fixes. The company announced a formal Next.js Security Release Program on July 13, 2026: roughly monthly, pre-scheduled security releases that disclose an expected ship date and the highest anticipated severity in advance, with CVE numbers and technical detail withheld until the fix itself is public (Next.js blog, July 13, 2026).

---

What changed

The program’s first scheduled release shipped on time, July 21, 2026, patching Next.js to 16.2.11 (Active LTS) and 15.5.21 (Maintenance LTS) against nine vulnerabilities, four of them high severity (Next.js blog, July 2026 Security Release).

The most severe is CVE-2026-64641, a CVSS 8.2 denial-of-service bug: a crafted request to an App Router app with at least one Server Action can trigger excessive CPU use that stalls further requests on the same process. It affects Next.js 13.0.0 up to 15.5.21 and 16.0.0 up to 16.2.11; apps on the Pages Router, or not using Server Actions, aren’t exposed (GitHub Security Advisory GHSA-m99w-x7hq-7vfj).

Two more hit CVSS 8.3. CVE-2026-64642 lets an attacker bypass middleware- or proxy-level checks in App Router apps built with Turbopack and a single configured locale, a setup meant to simplify routing, not weaken it. CVE-2026-64645 covers rewrites() and redirects() rules that build a destination hostname from request-controlled input: an attacker can point the rule at an arbitrary host, turning a rewrite into server-side request forgery and a redirect into an open redirect (SecureLayer7 Labs, CVE-2026-64645 writeup). A fourth, CVE-2026-64649, is SSRF in Server Actions running on custom servers. All four, and the five medium-severity fixes alongside them, are closed in the same two patch releases.

Netlify, which hosts Next.js apps but doesn’t maintain the framework, published its own changelog entry the same day pointing customers at the same two version numbers and telling them to upgrade and redeploy (Netlify changelog, July 21, 2026). A framework-level patch is every one of its hosts’ problem, not just its maintainer’s.

---

Why this matters

Vercel’s July 13 notice said four high and five medium-severity fixes were coming in eight days, without a single CVE number or technical detail attached (Next.js blog, next-security-release-program). That split is deliberate. Teams get enough signal to schedule an upgrade window and brief on-call before the patch lands, but nothing an attacker could use to reverse-engineer an exploit from the announcement itself. Emergency, unscheduled patches still ship immediately for anything actively exploited. The monthly schedule is a floor under routine disclosure, not a replacement for urgent response.

For a framework installed as widely as Next.js, that predictability is worth more than any single fix. A CPU-exhaustion bug in Server Actions or an SSRF hidden inside a routing rule are exactly the kind of defect that’s easy to ship and easy to miss in review; a published patch calendar means a team can plan around discovering the next one instead of learning about it from a scramble.

Key Takeaways

• Vercel’s Next.js Security Release Program, announced July 13, 2026, pre-discloses a patch’s date and worst-case severity roughly a month out, withholding CVEs until the fix ships.
• The program’s first release, July 21, 2026, patched Next.js to 16.2.11 and 15.5.21, fixing nine vulnerabilities: four high severity, five medium.
• The highest-severity fix, CVE-2026-64641 (CVSS 8.2), is a denial-of-service bug reachable through any App Router app using Server Actions.
• Netlify separately told its own Next.js-hosting customers to upgrade, a sign that a framework patch is a cross-platform obligation, not just Vercel’s.