Next.js launches monthly security release program to patch nine vulnerabilities

The Next.js framework announced a new monthly security release program, with the first update slated for July 20 2026. The release will address nine vulnerabilities (four high‑severity and five medium‑severity) affecting supported versions 16.2 and 15.5. The initiative replaces the project's former ad‑hoc patching approach, offering developers and hosting providers advance notice while still allowing emergency patches for actively exploited flaws.

Separately, the Next.js 16 series, first released in October 2025 and updated through 16.3, introduced several developer‑focused changes. Turbopack, built in Rust, became the default bundler, cutting production build times from roughly 24.5 seconds to 5.7 seconds. New caching mechanisms give developers explicit control, reducing stale‑data bugs. Additional features include persistent build caches, a Rust‑based React compiler, and new server‑action APIs such as updateTag(). These enhancements aim to improve performance, predictability, and security for the framework’s ecosystem.