# Next.js Moves to Scheduled Patching, Fixes 9 Flaws in First Release

Page: https://hirantha.me/blog/nextjs-moves-to-scheduled-patching-fixes-9-flaws-in-first-release
Published: 2026-07-30
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: nextjs, web-security, vercel, cve, javascript

> Next.js shipped its first pre-announced security release on 21 July 2026, patching nine flaws including four high-severity bugs.

## What shipped

On 21 July 2026, the Next.js team published patches for nine security vulnerabilities across the framework's two supported release lines. If you run Next.js, the fix is a version bump:

```bash
npm install next@15.5.21   # Maintenance LTS (long-term support)
npm install next@16.2.11   # Active LTS
```

The same fixes have landed in the 16.3 pre-release channel (`16.3.0-canary.92` and `16.3.0-preview.7`) and will ship in 16.3.0 proper when it goes stable. Nine Common Vulnerabilities and Exposures (CVE) entries were opened for the batch: four rated high severity, five rated medium. Independent trackers that logged the same release confirm that four-and-five split, so the count holds up.

## The four high-severity bugs

Two of the four are variations on the same theme: a Next.js server being tricked into calling a URL the developer never intended. If a `rewrites()` or `redirects()` rule builds its destination hostname from part of the incoming request, an attacker can point that destination at an arbitrary host even when the rule is supposed to be restricted to a known suffix. On a `rewrites()` rule that becomes server-side request forgery (SSRF) - the server itself makes a request to an attacker-chosen address, which can be used to reach internal services that aren't meant to be public. On a `redirects()` rule it becomes an open redirect instead. A related bug lets an attacker manipulate Host-related headers so that a Server Action - Next.js's mechanism for running server code from a form or event handler - forwards or redirects its outbound request to a malicious host on custom server setups.

A third high-severity bug is an authentication bypass: apps built with the Turbopack bundler that use the App Router and configure exactly one locale under `i18n.locales` can have their middleware skipped entirely, which means any auth or security checks that middleware is supposed to enforce never run.

The fourth is a denial-of-service (DoS) path: a crafted request to an App Router app with at least one Server Action can drive CPU usage high enough to stall further requests on that process.

## The five medium-severity bugs

The medium batch is a mixed bag. Two are cache-confusion bugs affecting a specific `fetch()` pattern - `fetch(new Request(url), differentInit)` - where a cached response body from one request can be served back for a different request to the same URL; one variant only triggers when the request body contains invalid UTF-8 byte sequences. One discloses internal Server Function and `use cache` endpoint identifiers to unauthenticated callers, which is mainly useful to an attacker doing reconnaissance ahead of a bigger attack. One is a memory-exhaustion DoS specific to Server Actions running in the Edge runtime. The last only bites self-hosted deployments that use the default image loader with remote images enabled (off by default): a malicious SVG can exhaust CPU through the `/_next/image` endpoint.

## Why this is really a process story

The patches matter, but the more interesting fact is that this is the first release under a new program. Vercel, the company behind Next.js, announced a week earlier that it was moving from ad-hoc, no-notice security patches to a pre-announced schedule: roughly monthly, with advance word on the release date and the worst severity level to expect, so teams can plan the upgrade window instead of being surprised by it. Emergency out-of-band patches still happen for anything already being exploited - the framework's response to the React2Shell exploit disclosed in December 2025 is the precedent cited for that path.

The stated reason for formalizing the program is the volume of vulnerability research hitting the industry, driven by large language model (LLM)-assisted bug hunting. The Next.js team pointed to Mozilla's disclosure of 271 issues in a single Firefox release, all surfaced by Anthropic's Mythos Preview tool, as the scale this kind of tooling can now operate at. Next.js said it runs comparable tooling against its own codebase - through an internal project called deepsec, its own security researchers, and an expanded bug bounty scope - specifically so more of these issues reach the vendor before an attacker finds them independently.

## If you host on Netlify

Netlify published its own breakdown of which bugs actually reach its platform. Three of the nine don't apply there: the Server Action SSRF (Netlify's edge layer rewrites the inbound `X-Forwarded-Host` header before it reaches the app), the SVG image DoS (Netlify serves images through its own Image CDN rather than the Next.js default loader), and the Edge runtime memory exhaustion (Netlify's edge functions run as isolated invocations with request body caps). The rewrites SSRF, the Turbopack middleware bypass, the Server Action DoS, both cache-confusion bugs, and the endpoint-disclosure bug are all still live on Netlify deployments. If you're hosting elsewhere - your own servers, a different platform - assume all nine apply until you've checked.

## What to do about it

- Check your Next.js version. Anything on 13.x or 14.x has no patch coming on those lines; move to a patched 15.5.x or 16.2.x release.
- If you're on 16.x with Turbopack and a single configured locale, treat the middleware bypass as urgent - it defeats auth checks outright.
- If any `rewrites()` or `redirects()` rule in your config derives its destination from request data, audit it for hostname validation regardless of whether you patch immediately.
- Redeploy after upgrading. A version bump in `package.json` without a redeploy leaves the old build running.
- If you're on Vercel or Netlify, check their platform-specific advisories before assuming a given CVE does or doesn't apply to your setup.

## Sources

- [July 2026 Security Release](https://nextjs.org/blog/july-2026-security-release), Next.js Blog
- [Next.js Security Release and Our Next Patch Release](https://nextjs.org/blog/next-security-release-program), Next.js Blog
- [Next.js security release (July 2026): what to know](https://www.netlify.com/changelog/2026-07-21-nextjs-security-vulnerabilities/), Netlify Changelog