Next.js Readies November 3 Patch for Seven Medium Flaws

Vercel's Next.js team has a scheduled security release going out today, Tuesday, November 3, 2026, addressing seven vulnerabilities the team has rated medium severity. That much is confirmed, directly from Vercel: the framework's maintainers gave advance notice of the release on October 27, 2026, as part of the formal, pre-announced security release program they adopted this past July. As of this writing, the detailed advisories — including the actual CVE identifiers, which Next.js versions are affected, and which versions carry the fix — have not yet been published. This article lays out exactly what Vercel has confirmed, what is still pending, and how the pattern of its 2026 security releases suggests teams should prepare while they wait for the specifics.

What Vercel has actually confirmed

The announcement itself is short. In a post titled "Upcoming Next.js November Security Release," published October 27, 2026 and authored by Jamiboy Mohammad and Sebastian Silbermann, the Next.js team wrote that it is "preparing a scheduled security release for Tuesday, November 3, 2026," adding that the release "will address seven medium vulnerabilities in Next.js." The post states plainly that the team "will publish the full advisories alongside the release, including impact, affected versions, and upgrade instructions," and recommends that teams "upgrade to a patched version once the release is available."

That is the entirety of the technical detail Vercel has made public ahead of time. There is no breakdown of what parts of the framework are implicated — nothing about the Image Optimization API, the App Router, Server Actions, caching, or middleware specifically — and no mention of affected version ranges. The advance notice exists to give teams a heads-up and a date to plan around, not to pre-disclose exploitable detail before a fix is ready.

The seven vulnerabilities: all medium, nothing more granular yet

"Medium severity" is the one classification Vercel has committed to publicly, and it is worth noting what that does and doesn't rule out. Under the severity scale Next.js has used throughout 2026, medium-rated issues have historically included things like cache poisoning that serves the wrong page to a user, information disclosure limited to development-only endpoints, and conditions that require fairly specific application configurations to trigger — as opposed to the critical, unauthenticated remote-code-execution bugs the project patched on an emergency, out-of-band basis in September and October. A release where every one of seven issues lands at medium, with no criticals or highs mixed in, would be a comparatively mild month by the standards Next.js has set for itself this year.

That said, "nothing more granular yet" means exactly that. Until the advisories are live, there's no way to confirm which rendering mode, router, or deployment target (Vercel-hosted versus self-hosted) each issue touches, and no way to confirm whether any of the seven require non-default configuration to be exploitable — a detail that has meaningfully narrowed real-world impact in several of this year's prior releases.

Why Vercel pre-announces releases like this one

This is the fourth scheduled release under a program Vercel formalized on July 13, 2026, in a post titled "Next.js Security Release and Our Next Patch Release." The team explained at the time that it had historically shipped security patches on an ad-hoc basis, with no advance notice, which it said "caused disruption for our users." Moving to a monthly, pre-announced cadence — "standard practice for major open source projects," in the team's words — lets engineering teams plan upgrade windows in advance, and lets Vercel coordinate with hosting providers and platform partners on interim mitigations, such as firewall rules, for applications that haven't patched yet by the time details go public.

The July post also attributed the rising pace of security findings in Next.js partly to AI-assisted vulnerability research across the industry, pointing to Mozilla's disclosure of 271 issues in a single Firefox release surfaced by automated tooling as an example of the trend. Vercel said it runs comparable tooling against Next.js itself, through an internal project called deepsec, alongside its own researchers and an expanded bug-bounty scope, specifically so more issues reach the team before outside attackers find them.

Under that program's own rules, each advance notice is supposed to include "the expected release timeline and the highest anticipated severity among the vulnerabilities it covers" — which is exactly what the October 27 post delivered: a date (November 3) and a severity ceiling (medium). Full technical detail, including CVE numbers, is reserved for the day patches actually ship, which is standard practice for coordinated vulnerability disclosure — it keeps exploit-relevant detail out of attackers' hands until a fix exists.

What's still not known as of publication

To be direct about the limits of what can be reported right now: Vercel has not published the CVE identifiers for any of the seven November issues, has not said which Next.js release lines (16.x canary/stable, 15.5.x maintenance LTS, or earlier) are affected, and has not named the patched version numbers teams should upgrade to. A check of the official Next.js blog's post listing and of the GitHub Security Advisories database for vercel/next.js as of this writing shows the most recent published advisories dating to October 14, 2026 — nothing yet tied to a November 3 publication date. The November 3 blog post itself has not appeared at the time of writing either; only the October 27 advance notice is live.

Any article, forum post, or social media thread that cites specific CVE numbers, CVSS scores, or affected-version ranges for this particular November 3 release before Vercel's own advisories are public should be treated with caution — those details simply are not confirmed yet. This piece will not guess at them.

Next.js's 2026 track record, for context

The table above summarizes what Vercel has actually published this year under the scheduled-release program, each entry drawn from the corresponding official blog post. The July release patched nine issues — four high severity (including a Server Actions denial-of-service bug tracked as CVE-2026-64641 and a Turbopack middleware-bypass issue tracked as CVE-2026-64642) and five medium severity, landing in v16.2.11 and v15.5.21. August brought forward an already-scheduled release after the team found an additional critical flaw in an upstream dependency, ultimately patching two critical-severity issues — one an unauthenticated remote-code-execution bug in AVIF image optimization tied to the libheif library used by sharp, the other a Windows-specific remote-code-execution issue (CVE-2026-75604) — in v16.3.3 and v15.5.24.

September's release covered seven named issues plus two more that had to be postponed over upstream dependency delays, split across one high severity (a Server-Side Request Forgery bug in Image Optimization, CVE-2026-94483), five medium-severity issues (including two separate cache-poisoning bugs and a Draft Mode content-leak issue), and one low-severity development-server information disclosure bug, patched in v16.3.8 and v15.5.27. The two postponed issues — a critical unauthenticated remote-code-execution bug in use cache functions and a high-severity Server Actions denial-of-service issue, both tied to upstream React advisories — shipped two weeks later, on October 14, 2026, in an out-of-band update to v16.4.1 and v15.5.28, alongside a third critical issue affecting SVG handling in the Image Optimization API.

Read together, the pattern through October is that Next.js's scheduled releases have consistently mixed severities, usually including at least one high or critical issue. A release where Vercel has committed in advance to a ceiling of medium severity across all seven issues — assuming that holds once the detailed advisories land — would be the first scheduled release of the program's four-month history to come in under that bar. If you've been keeping up with the site's coverage of the October critical RCE patches, this is a markedly different risk profile, at least based on what's been disclosed so far.

Who should be paying attention

Because the specific affected versions aren't public yet, the safest working assumption for any team running Next.js in production is the same one Vercel's own advisories have repeatedly reinforced this year: both the current Active LTS line (16.x) and the Maintenance LTS line (15.5.x) have received fixes in every scheduled and out-of-band release so far, so teams on either line should expect to be in scope for at least some of the seven issues. Teams that have already moved to Next.js 16.4, released in October, are not automatically exempt — several of this year's advisories affected the then-current stable release at the time they were disclosed.

Self-hosted deployments have been disproportionately represented in 2026's medium-severity findings specifically — cache-poisoning issues in September's release, for instance, explicitly did not affect applications deployed on Vercel's own platform, because Vercel's infrastructure handles caching differently than a typical self-hosted setup. Teams running Next.js outside of Vercel's platform, on their own servers or another host, should treat today's release as the highest-priority one to review in full once it's live, since self-hosted configurations have been the ones most often called out as affected in this category of bug.

How to prepare before the advisories land

None of this requires guessing at technical detail that hasn't been published. It's the same preparation Vercel's own program is designed to enable: know your version, know where to look, and be ready to act the moment the real advisories go live.

Vercel's bug bounty and disclosure process

Every one of Vercel's 2026 security posts, including the November advance notice, closes with the same note on how these issues reach the team in the first place: Next.js and other Vercel-maintained open source frameworks are in scope for Vercel's Open Source Bug Bounty program on HackerOne, which the company says it uses to work with outside security researchers on an ongoing basis. Vercel also publishes a direct contact, [email protected], for questions about its security programs or vulnerability management outside the bounty program itself. That combination — a paid bounty program plus a formal, monthly disclosure cadence — is the infrastructure behind today's release, and it's the same process that produced the five prior advisories summarized above.

What's next

The detail that actually matters for engineering teams — CVE numbers, affected version ranges, and the exact patched versions to upgrade to — should arrive from Vercel later today or in the immediate aftermath of November 3, following the same format as the July, August, September, and October posts: a blog entry naming each issue, its CVE and GitHub Security Advisory identifiers, its severity, and the specific package versions that fix it. Once that post is live at nextjs.org/blog, it will supersede the advance notice this article is built on, and any affected-version or CVE claims should be checked against that primary source directly rather than against secondary summaries. Pandromeda will revisit this topic with the confirmed technical detail once Vercel's advisories are public.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage