Next.js ships v16.3.6 and v15.5.26 with next/og security patches
On September 22, 2026, Vercel released two Next.js versions: v16.3.6 with a fix for the RCE vulnerability GHSA-vcvr-r3jv-pc5j in next/og ImageResponse, and v15.5.26 with additional security hardening for the same component. Both releases contain a single changelog item and add no new features.
- v16.3.6 fixes RCE in next/og ImageResponse (GHSA-vcvr-r3jv-pc5j)
- v15.5.26 contains only security hardening for next/og
- Both releases shipped on September 22, 2026, a minute apart
- Each changelog has a single item with no new features
Read next
Security