Next.js will patch seven vulnerabilities on November 3

In a notice dated October 27, 2026, the Next.js team said it will ship a scheduled security release on Tuesday, November 3, 2026. The release fixes seven medium-severity vulnerabilities. Details stay private until release day.

What does the notice say?

The advance notice on the Next.js blog says it exists so teams can plan upgrades before patches are published. Affected versions, impact and upgrade instructions will be published on November 3 together with the advisories. Once the patches are out, the team recommends upgrading to a patched version.

What can you do beforehand?

Before release day the useful steps are preparatory. Know which Next.js version your project runs, and check it in the lockfile. Have a preview environment where you can try the upgrade. When the release lands, compare your version with the affected range in the advisories; if you are inside it, move to the patched version and test.

Because the notice does not describe the seven issues, it is too early to say which applications are affected or how. We build client sites and our own site with Next.js and will check versions on the same schedule once the details are published. If you are unsure who maintains your site's infrastructure, you can ask us under our web design service.