Next.js pre-announces Sept 30 security release fixing 9 vulnerabilities
cramforce · x · 2026-09-24
Next.js has pre-announced a scheduled security release for September 30, 2026, addressing nine vulnerabilities: one critical, two high, five medium, and one low. Patches will ship as 16.3.7 and 15.5.27 with full advisories, and teams are advised to upgrade promptly. Vercel maintains its security program through an open source bug bounty. Vercel's CTO adds a PSA: apps doing direct image processing (very common outside frameworks) should update dependencies at least weekly.
More from coding & agent
- Standard Code launches unlimited-usage cloud coding agent with $49/mo per-line billing — jasonkneen · 2026-09-24
- Lovable Chat tutorial: voice, file creation, and auto-posting to X via Metricool MCP — MyCreativeOwls · 2026-09-24
- Lovable Chat hands-on: voice, file creation, and auto-posting to X via Metricool MCP — MyCreativeOwls · 2026-09-24
- LangSmith Engine v2 adds agent red teaming and automated fix validation — LangChain · 2026-09-24
- Ando raises $20M to build the 'AI-native Slack' for teams working with agents — beh_zod · 2026-09-24
- Sentry founder: Claude drives 10x Codex's usage, Cursor about 3x — zeeg · 2026-09-24