Skip to content

Next.js schedules a security release for 3 November

Vercel is giving advance notice of a scheduled patch fixing seven medium-severity vulnerabilities in Next.js, with full advisories to follow on release day.

Source: Next.js

Vercel posted a heads-up on 27 October that Next.js will ship a scheduled security release on Tuesday 3 November. It will fix seven vulnerabilities, all rated medium severity.

As with October’s out-of-band release, there’s nothing to act on yet beyond the date. Vercel isn’t naming the affected versions or the nature of the bugs; full advisories, including impact and upgrade instructions, land alongside the patch itself. The post also points to Vercel’s Open Source Bug Bounty on HackerOne for researchers who want to contribute to Next.js security work directly.

Why it matters: seven bugs in one release is a reasonable number to plan around rather than discover on the day. Put 3 November in the diary if you run Next.js in production, and leave room to upgrade once the advisories land.

The caveat: medium severity, not critical, so this doesn’t carry the same urgency as October’s release. Worth tracking rather than blocking time off for.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Machine learning for web developers: the only mental model you need

You do not need calculus to work with models. You need one idea, that a model is a function you fit instead of write, and the rest follows from things you already know.

Web

View transitions without a framework

Animating between two states used to mean keeping both in the DOM and choreographing them by hand. The browser will now do the hard part for you, in about six lines.

More from The Wire

All briefs