On October 14 the Next.js team shipped the out-of-band update promised on October 8: fixes for two Critical and one High severity vulnerabilities in upstream dependencies. Both Next 16.x and 15.x lines received patched versions.
Do this in order
- Read the advisory and find the patched version numbers for the line your build pins.
- Bump the dependency, run the build, run the tests.
- Deploy the same day; a fix resting on a laptop is not a fix.
- Then read the CVE text so next time you can judge an advisory in minutes instead of an afternoon.
With a formal security-release program announced in July, an August release on August 25 and a September one on September 30, the cadence is public and dependable. The recurring calendar slot beats the emergency scramble every time.
A pinned version that never gets deployed is a lock on an empty box. Ship it.