Next.js will patch two critical bugs out-of-band on 14 October
Vercel is pre-announcing an out-of-band security release fixing two Critical and one High severity vulnerability in upstream dependencies, two of them carried over from September.
Vercel posted a heads-up on 8 October that Next.js will ship an out-of-band security update next Wednesday, 14 October 2026. It fixes three vulnerabilities in upstream dependencies: two rated Critical, one High.
Two of the three fixes were originally meant for the September security release but got pushed back for upstream coordination. Vercel isn’t naming the packages, CVEs, or affected version ranges yet — that detail lands with the advisories themselves when the patch goes out.
Why it matters: if you run Next.js in production, put 14 October on the calendar now rather than waiting to notice the release. Two Critical-severity bugs in upstream dependencies is enough to justify an out-of-cycle patch, and Vercel is explicit that you should upgrade as soon as the update lands.
The caveat: there’s nothing to act on yet beyond scheduling the time — no advisory, no patched version, no indication of whether the bugs are already being exploited. That all arrives with Wednesday’s release.