Next.js Launches Monthly Security Release Program, Patches 9 Vulnerabilities
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
Mark your calendar: Next.js now ships security patches on a predictable monthly schedule. The first landed July 20 in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS). You get a fixed window each month to review and apply updates instead of scrambling on the previous ad-hoc patch process.
The release fixes 9 vulnerabilities: 4 high severity and 5 medium. High-severity patches close two SSRF vectors: one in rewrites and redirects where attacker-controlled hostnames redirect to arbitrary hosts, and one in Server Actions on custom servers via Host header manipulation. A Denial of Service via crafted Server Action requests and a Turbopack middleware bypass for single-locale i18n configurations round out the high-severity fixes. Medium-severity fixes cover two cache confusion bugs (fetch response bodies from different requests to the same URL could get mixed), image optimization CPU exhaustion from malicious SVGs, an unbounded Server Action payload in the Edge runtime, and unauthenticated disclosure of internal Server Function endpoint IDs.
Upgrade with npm install next@16.2.11 (16.x) or next@15.5.21 (15.x). The SSRF fix in rewrites will break configurations that build hostnames from user-controlled input: audit your rewrite and redirect rules before deploying. Block out the monthly release window in your team's patch cycle.