The Next.js team has announced a scheduled security release targeting July 20, 2026.

The release is expected to include patches for Next.js 16.2 and 15.5 and address nine security issues:

Four high-severity vulnerabilities

Five medium-severity vulnerabilities

The technical details and CVE identifiers have not been published yet. That is intentional. Full details are expected when patched versions become available.