JavaScript framework security patches

In mid‑July 2026 the maintainers of the Next.js web‑framework announced a new monthly security release program. The first update, scheduled for July 20, will patch nine vulnerabilities (four high‑severity and five medium) in versions 16.2 and 15.5, while preserving the ability to issue emergency fixes for actively‑exploited issues. The announcement also highlighted recent performance and developer‑experience upgrades in the Next.js 16 series, including the Rust‑based Turbopack bundler and new caching and server‑action APIs.

A few weeks later, on July 29, the Node.js project released an emergency security update covering all active release lines (v22.23.2, v24.18.1, v26.5.1). The patch addresses ten to eleven CVEs, among them three high‑severity flaws in the HTTP/2 implementation that could allow memory‑limit bypass or heap use‑after‑free, and a permission‑model issue permitting path‑traversal. Additional medium‑severity fixes target DNS handling, TLS session reuse, Zlib crashes, SQLite handling, and bundled dependencies. Developers were urged to upgrade immediately.

Together, these actions illustrate a broader push within the JavaScript ecosystem to adopt more systematic and rapid vulnerability remediation, combining scheduled monthly releases with ad‑hoc emergency patches to protect developers and users of widely‑used runtime and framework components.