The first monthly Next.js security release asks Active LTS users to move to 16.2.11 and Maintenance LTS users to move to 15.5.21. The release addresses four high-severity and five medium-severity vulnerabilities.
Before this work, this repository was on Next.js 16.2.7, below the new Active LTS baseline. The same PR updates next and @next/mdx to 16.2.11 and reruns type checking, linting, the static build, and browser smoke tests.
That version gap is not proof that one of the listed vulnerabilities was reachable on this site. Exposure still depends on the affected feature and deployment shape. The gap is enough reason to patch first and investigate scope second.
My maintenance checklist is straightforward:
- Track the current Active and Maintenance LTS lines.
- Keep
nextand@next/mdxon the same release. - Read advisory scope instead of inferring exposure from a version number.
- Rebuild static output and post-build indexes after each patch.
The useful change is cadence. Security patches should not wait for the next feature upgrade or a public incident. A small, repeatable patch workflow is cheaper than treating every framework advisory as emergency work.
Official sources: July 2026 Security Release and Next.js Support Policy.
Trademark notice: Vercel, the Vercel design, Next.js and related marks, designs and logos are trademarks or registered trademarks of Vercel, Inc. or its affiliates in the US and other countries.