Next.js Security Updates: How to Stay Patched in 2026

Legacies is an independent digital product brand based in Bucharest, Romania, founded by Horia Stan and Alexandru Tălnaci, and most of what we ship runs on Next.js. That means we read every Next.js security advisory, and lately there have been a lot of them.

So here is the short version. Next.js now publishes security fixes on a predictable, roughly monthly schedule, with advance notice. Staying safe means knowing which version you run, having a tested way to upgrade within days, and treating that as ongoing product work rather than an emergency.

Quick answer

• As of October 5, 2026, the patched versions are 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS). Anything older in those lines is missing fixes.
• Next.js 14 and earlier no longer get security updates under the official support policy. If you are still there, plan the upgrade now.
• Since July 2026, the Next.js team announces security releases in advance on the Next.js blog. Urgent issues still get out-of-band patches.
• A calm monthly update window, a version inventory, and a rollback path cover most of the risk for a small business site or app.

What changed: Next.js moved to scheduled security releases

On July 13, 2026, the Next.js team formalized a security release program. Before that, fixes arrived as ad-hoc patches with no warning. Now, roughly once a month, they publish a notice with the expected release date and the highest severity involved. That gives teams time to plan, and it lets hosting providers put mitigations like firewall rules in place before details go public.

They were also honest about why: AI-assisted tools are finding bugs faster. More bugs found means more patches, and "we will update when something breaks" is no longer a workable plan.

The 2026 releases so far

Here is what shipped in the last few months, straight from the official advisories:

And before the program existed, there was React2Shell. In December 2025, a flaw in the React Server Components protocol allowed remote code execution, rated CVSS 10.0. Next.js tracked it as CVE-2025-66478, there was no workaround, and the team later advised rotating every secret on apps that stayed unpatched. That is the kind of week a maintenance plan is for.

"We do not collect much data" is not a maintenance plan

We hear this a lot. The site is simple, so why worry?

Because simple sites are rarely that simple. Most have a contact form, analytics, a newsletter integration, maybe an admin route or a small dashboard. Even a mostly static site has a build pipeline and a few hundred packages behind it. A framework vulnerability is not automatically a breach. But a public server running known-vulnerable code is an easy target, and automated scanners do not care how small your business is.

The goal is not to update everything the minute it appears. Rushed upgrades create their own risk. The goal is a calm operating rhythm:

• Know the framework and runtime versions currently in production.
• Subscribe to the security advisories for the systems you use.
• Test security updates in an environment that resembles production.
• Keep a short record of what changed and when it went live.
• Have a quick path to roll back if a patch breaks a critical integration.

A team with a monthly update window can respond to a security release in hours. A team that has not touched its project in two years has to rediscover the whole system under pressure.

A patch routine that fits a small team

This is roughly the routine we follow on the projects we maintain. It works for one marketing site and scales fine to a handful of apps.

1. Check what you are runningRun npm ls next in the project, or look at the lockfile. Write down the exact version for each site. If you do not know which repository is behind a live site, that is the first thing to fix.
2. Follow the official channelsWatch the Next.js blog and the GitHub security advisories for the repository. Enable Dependabot or a similar alert tool so a vulnerable version shows up as a pull request, not a surprise.
3. Read the conditions, not just the severityFor each advisory, check whether you use the affected feature. Self-hosted or managed hosting? Pages Router or App Router? Image optimization with remote images? Windows server? This tells you whether to patch today or in the next window.
4. Upgrade inside your release lineStay on your line and move to the latest patch, for example npm install [email protected]. Patch releases are designed to be safe. Save major upgrades for a planned project.
5. Test, deploy, verifyBuild, run your tests, click through forms and logins on a staging copy, then deploy. Confirm the live version afterwards. Write one line in a changelog.

Self-hosted vs managed hosting

Where you host changes who does part of this work. Platforms like Vercel and Netlify often deploy firewall mitigations for known issues, and some advisories explicitly say platform-hosted apps are not affected. That buys time. It does not replace the upgrade.

If you self-host, the job is fully yours. The Next.js self-hosting guide recommends a reverse proxy like nginx in front of the Next.js server to handle malformed requests, slow connections and rate limiting. Our own site runs that way, as a Node.js server in Docker behind a proxy. It is a good setup, but someone has to rebuild the container when a patch lands.

The dependency layer matters as much as the framework

Look at the August and September releases again. Two of the critical issues came from upstream libraries: libheif behind sharp, and satori behind next/og. You did not install those directly, and you still had to patch them.

That is why Next.js maintenance is really dependency maintenance. Keep the lockfile in version control, review dependency changes in pull requests, and be careful with install scripts. We covered that side in our posts on npm supply chain security and what npm v12 changed for install scripts.

The hidden cost of a "one-and-done" website

The one-and-done model is tempting: launch the site, pay the invoice, leave it alone until a redesign. It usually creates the most expensive kind of work later. Old dependencies, expired integrations, an abandoned form inbox and unclear hosting credentials stay invisible until they fail.

The cost is not only technical. A broken contact form loses leads. A defaced page loses trust. An emergency fix interrupts the team and costs more than planned maintenance would have. If you are still budgeting a new site, include upkeep from day one. Our guide on how much a business website costs in 2026 breaks that down.

This is exactly what our Monthly Maintenance plan at Legacies covers: around-the-clock monitoring, monthly technical updates, weekly backups and 2 hours of edits, for 499 lei per month (about 95 EUR), with no fixed-term contract. You can see the details on our services page. If you are not sure where your site stands, our free website audit gives you a quick first read on speed, mobile and SEO basics.

Make an update policy that fits the business

For a small marketing site, a monthly review plus alerts for critical issues is usually enough. For a product handling accounts, payments or customer data, updates and monitoring need a tighter cadence. The right answer depends on risk, not on how expensive the site was to build.

Start with an inventory: hosting, framework version, database, email provider, analytics, domains and everyone with access. Assign an owner to each. This is not paperwork for its own sake. It is how you stop a former contractor's account or an unpatched library from becoming next month's emergency.

The visible product is the page a customer sees. The durable product is the process that keeps that page reliable six months later. Scheduled security releases just make that harder to ignore.

When to handle it yourself vs bring someone in

Handle it yourself if you have a developer who knows the codebase, the site lives in a repository with working builds, and someone actually reads the advisories each month. Then the routine above is a couple of hours per release.

Bring someone in if nobody can say which Next.js version is live, the original developer is gone, you are on Next.js 14 or older, or a critical advisory lands and you cannot deploy within a day or two. A short, written handover plus a maintenance plan is cheaper than one incident.

Frequently Asked Questions

What is the latest secure version of Next.js?

As of October 5, 2026, the latest patched releases are Next.js 16.3.8 on the Active LTS line and 15.5.27 on the Maintenance LTS line, both from the September 30 security release. Check the official Next.js blog before upgrading, because new security releases now arrive roughly every month.

How often does Next.js release security patches?

Since July 2026, Next.js runs a formal security release program with roughly monthly releases announced in advance on its blog. Each notice gives the expected date and the highest severity involved. Critical or actively exploited issues can still get out-of-band patches, like the one on September 22, 2026.

Is Next.js 14 still supported?

No. Under the official support policy, only Next.js 16 (Active LTS) and Next.js 15 (Maintenance LTS) receive security fixes. Next.js 14 and earlier are unsupported, so apps on those versions should plan an upgrade, ideally to the latest 16.x release.

Does hosting on Vercel mean I do not need to update Next.js?

Not quite. Managed platforms often deploy firewall mitigations, and some advisories say platform-hosted apps are not affected by a specific issue. But other vulnerabilities affect every deployment, so you still need to upgrade the next package in your project and redeploy.

How do I check which Next.js version my site uses?

Open the project and run npm ls next, or search for the next entry in package-lock.json. If you do not have access to the code, ask whoever built or maintains the site. Not knowing the version is itself a sign the site needs a maintenance owner.

What was React2Shell and does it still affect sites?

React2Shell was a critical remote code execution flaw in React Server Components disclosed in December 2025, tracked in Next.js as CVE-2025-66478 with a CVSS score of 10.0. It affected App Router apps on Next.js 15 and 16. Any app that has applied a later security release is patched, but apps that stayed unpatched should also rotate their secrets.

How much does Next.js maintenance cost for a small business?

It depends on how complex the site is and who does the work. At Legacies, our Monthly Maintenance plan is 499 lei per month, about 100 EUR, and covers monitoring, monthly updates, weekly backups and 2 hours of edits. A simple site with an in-house developer may only need a few hours per security release.