Announcing a security release before shipping it sounds like inviting trouble, but it is exactly what makes the trouble smaller: the date, September 30, 2026, is on the record, and the team commits to publishing details alongside the patched versions.

Published 2026-09-23: https://nextjs.org/blog/upcoming-nextjs-security-release-september-2026

Why the advance notice helps

  • Maintainers can schedule the patch window before any advisory text exists, which turns an emergency into an ordinary maintenance slot.
  • The follow-up carries the fixed versions, so the mapping from your deployed version to the upgrade is one lookup on release day.
  • Teams running a mix of Next.js 15 and 16 lines should note their current patch levels now, because the summer batch already landed and the mapping work compounds.

The program is gacor in its quiet way: schedule, ship, publish details, and everyone else plans around a notice rather than a rumor. A release calendar nobody dreads is an gacor artifact of process design.

Check your deployed version the morning the release lands; upgrades take minutes, and the plan ships the day before.