Next.js security advisory (AV26-851)
Canada's Cyber Centre warns Next.js 15.5 and 16.3 are affected by critical vulnerabilities; users should update to 15.5.24 and 16.3.3.
The Canadian Centre for Cyber Security (AV26-851) warns that Next.js versions 15.5 prior to 15.5.24 and 16.3 prior to 16.3.3 are affected by critical vulnerabilities. Administrators are urged to review the vendor advisory and apply the August 2026 security release updates. The bulletin provides no CVE ids or exploitation details.
- Critical vulnerabilities affect Next.js 15.5.x before 15.5.24 and 16.3.x before 16.3.3
- Fixes ship in Next.js 15.5.24 and 16.3.3 via the August 2026 security release
- Canadian Cyber Centre urges administrators to update promptly
- Products
- Next.js
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
Serial Number: AV26-851 Date: August 26, 2026 As of August 25, 2026, Next. js is affected by critical vulnerabilities in the following product: Next. js Version 15.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.