Socket: Next.js Moves to Scheduled Security Releases

What it is

Vercel's new Next.js security release program, as reported by Socket. Beyond the summary's framing, the concrete operational details matter to anyone running Next.js: a fixed cadence, named affected branches, and a sharp Vercel-hosted vs. self-hosted risk split.

How it works

Vercel will post advance notice of security releases on the Next.js blog roughly monthly. Each notice states the expected release date and the highest anticipated severity, but withholds CVE specifics (an embargo) until patches land. Urgent or actively-exploited bugs still ship immediately, outside the schedule. This mirrors Django, Node.js, Kubernetes, and OpenSSL.

The advance-notice window exists partly so Vercel and hosting/platform partners can pre-deploy mitigations — e.g., WAF/firewall rules — before the patch is public.

Preconditions / Affected

• First scheduled release: July 20, shipping patch releases for Next.js 16.2 and 15.5, covering 4 high and 5 medium severity vulnerabilities (nine total).
• Self-hosted deployments carry the risk. During React2Shell (CVE-2025-55182) and the x-middleware-subrequest bypass (CVE-2025-29927), Vercel-hosted apps were protected automatically via WAF rules delivered before public disclosure; self-hosted apps were not.
• Next.js sits deep in dependency trees, so teams not running Next.js directly may still need to act on a given release.
• Which versions receive backports is governed by the LTS policy that came out of the March 2025 x-middleware-subrequest postmortem.

What to do

• Watch the Next.js blog for the pre-announcement; use the stated date and severity to schedule an upgrade window in advance.
• If self-hosted, treat the gap between scheduled disclosure and completed upgrade as the exposure window attackers target — plan to patch on release day, not after, and stage your own WAF mitigations since you won't get Vercel's automatically.
• Audit transitive dependencies for Next.js, not just direct usage.

The page gives no patch commands or CVE IDs for the July 20 release itself — those publish when patches land.

Caveats

• CVE details for the scheduled release are embargoed until the patches are available, so the nine-vulnerability count and "4 high / 5 medium" split are Vercel's anticipated figures, not confirmed advisories.
• The React2Shell fix was incomplete: the initial patch for one follow-on issue required a second patch under CVE-2025-67779, and reviewers found two further RSC flaws (CVE-2025-55183, CVE-2025-55184) while examining the fixes — a reminder that a single scheduled release may not fully close a vulnerability class.