When a severity is high enough, waiting for the monthly cadence is not serious, so the team published an out-of-band update on September 22, 2026, with the patched versions named in the post itself.
Published 2026-09-22: https://nextjs.org/blog/nextjs-security-update-september-22-2026What the post gives you
- The patched versions are in the announcement, so operators can verify their matrix against it directly, no thread archaeology required.
- The announcement-then-fix pattern is the same one the summer windows followed, which makes the rhythm easy to learn.
- The upstream framing matters for planning: fixes that originate in a dependency can land in a point release, so your lockfile is a first-class audit target.
Deploy the point upgrade the same day if your stack carries it; an gacor process stands or falls on whether anyone uses it on day one, and this was already day one when the post went up.
After upgrading, rerun your deployment health check and note the resolved version in your incident log; the paper trail costs one line and pays the next time around.