SECURITY · FRAMEWORK OPS
On July 13, Vercel formalized a security release program for Next.js: roughly monthly, pre-announced, with a severity ceiling published in advance and the CVE specifics held back until the patch itself ships. The first one covers 4 high and 5 medium severity issues in Next.js 16.2 and 15.5, originally slated for July 20, now shipping July 21. This is a small working demo of what changes between the old ad-hoc model and the new one, not the vulnerability count, but who gets a head start and how long it lasts.
Same nine vulnerabilities, two release models
Next.js patches 4 high and 5 medium severity issues either way. Toggle the model to see what changes: who gets a head start, and how long it lasts.
Jul 13 · VERCEL
Vercel posts that a release is coming, with only the severity ceiling disclosed: 4 high, 5 medium. No CVE numbers, no affected code paths, no exploit path. Nothing here is useful for building an attack yet.
Jul 13 → 21 · DEFENDER
Hosting providers and platform teams use this gap to stage WAF rules and check which live apps sit on the named minor versions, before there is anything specific to exploit.
Jul 21 · ATTACKER
Now the specifics land: CVE numbers, affected paths, the fix itself. Defenders who used the window are already patching. Attackers are starting from zero, same as before, just eight days later.
Under the new model, the defender's head start is the whole advance-notice window, roughly 8 days here, before any exploit-relevant detail exists.
Check my own stack against the affected range
0 / 4 marked patchedAll four sit on Next.js 16.2.x or 15.5.x, the exact minors named in the July release. Real versions, read from each repo's package.json on 2026-07-21. Checking a box here does not patch anything, this is a reminder list, not a deploy tool.
WHY THIS MATTERS FOR CLIENT WORK
Every Next.js app I run for myself or a client is pinned to some minor version, and I do not always know off the top of my head which ones sit in a named release's affected range. The useful habit is not waiting for a CVE alert, it is checking package.json across live projects the day the advance notice posts, before there is anything specific to exploit. Four of my own live projects came back in range for this one. The advance notice is the whole point: it turns patching into a scheduled task instead of a fire drill.
Built 21 July 2026 · pattern sourced from Next.js's security release program