The Next.js team gave advance notice that on 26 August 2026 it will publish a security release for a critical-severity vulnerability, in versions 16.3.3 and 15.5.24, with the full advisory, impact, affected versions and upgrade instructions. The CVE details are not public yet, as is normal for a heads-up. This is not red tape: it is the window in which you can prepare before the patch code, and therefore the flaw, becomes analysable by anyone.
Why the advance notice matters
When a patch ships, attackers diff the code and reconstruct the vulnerability in hours. We saw it in July with WP2Shell on WordPress: the first attempts arrived the same evening as the release. A heads-up flips the advantage: it gives you a few days to know which applications are exposed and to plan the deploy window, so that on 26 August you upgrade in minutes instead of discovering the problem while it is being exploited.
What to do in the days before the 26th
- Version inventory: which of your applications run on a 16.x or a 15.x, and on which exact minor. Not "we use Next", but the precise list of deployments.
- A booked deploy window: who upgrades, with what rollback procedure, in how long. Patch day is not the time to improvise the pipeline.
- Self-hosted versus managed: on Vercel the upgrade is a redeploy, but self-hosted apps behind your own reverse proxy are on you, and they are the ones that stay exposed longest.
- The at-risk surface: Next.js has had past CVEs in middleware and request handling. Without the detail, it is worth reviewing where middleware does authorisation, historically the most fragile part.
Verdict
Put 26 August on the calendar and treat it as an operational deadline, not a notification to file. Vercel's heads-up hands you an advantage you usually do not get, and wasting it by waiting for the details means turning up at exploitation time with your homework undone. Upgrade as soon as the release is out, check self-hosted apps first, and remember that with a critical vulnerability the distance between patch published and patch applied is exactly your exposure.