On 20 July 2026, the Next.js team published its first monthly security release. The announcement described a coordinated framework update addressing four high-severity and five medium-severity vulnerabilities. It identified Next.js 16.2.11 as the Active LTS release and 15.5.21 as the Maintenance LTS release containing the fixes.
A release, not one reported breach
The public announcement was a grouped security release rather than a report of one attack against every Next.js user. This distinction matters. A vulnerability describes a weakness that may be exploitable under particular conditions; an incident describes observed compromise. The July notice communicated patched framework versions and severity counts.
The process changed first
One week earlier, on 13 July, the Next.js team announced a formal process for more regular security patches and advance notice of coordinated releases. The 20 July packages were the first result of that cadence. The model resembles scheduled patch windows used elsewhere in infrastructure software: fixes can be coordinated, communicated and consumed as a release line.
The May 2026 backdrop
The new process followed a significant coordinated release on 7 May 2026. That earlier release addressed thirteen advisories spanning middleware and proxy bypass, denial of service, server-side request forgery, cache poisoning and cross-site scripting. It also included the upstream React Server Components issue CVE-2026-23870. Next.js 15.5.18 and 16.2.6 were the fixed framework versions named at that time.
Vendor resolution
For the July release, the Next.js project’s stated resolution was the patched LTS packages: 16.2.11 or 15.5.21. The information is version-specific and time-specific; later releases can supersede those numbers.
Primary sources: Next.js July 2026 Security Release, Next.js release index, and Vercel’s May 2026 security release summary.