Next.js upgrades and support: which versions still get fixes?

Only two Next.js versions still get security fixes. Next.js 16 is in Active LTS and Next.js 15 is in Maintenance LTS, and the Next.js team will ship fixes for 15 only until 31 January 2027. Next.js 14 and everything older are unsupported. If your app runs 15 or 16, move to the latest release in your line now and plan the move to 16 if you are on 15. If it runs 14 or older, plan the upgrade now: fixes published in 2026 for problems that also affect 14 and older have shipped only for 15 and 16.

This guide sets out what the support policy means for your app, what React2Shell and the 2026 advisories taught, how to check your app in a few minutes and what changes when you upgrade to Next.js 16. Every version and date below was checked against nextjs.org, vercel.com and the Next.js advisories on GitHub on 13 November 2026, and each one is linked so you can check it again.

Which Next.js versions are still supported?

Under the Next.js support policy, a major version is in Active LTS until the next major is released, with new features, bug fixes and vulnerability fixes. It then moves to Maintenance LTS, which brings only critical bug fixes and essential vulnerability fixes, for two years from its first release.

• Next.js 16 (released 21 October 2025): Active LTS.
• Next.js 15 (released 21 October 2024): Maintenance LTS. Its two years ended on 21 October 2026, and the Next.js team has extended fixes for 15 to 31 January 2027 to give teams more time to upgrade.
• Next.js 14 and older: unsupported.

The policy says the team may, in rare cases and depending on severity, patch a version outside it. That is not something to plan around. The last 14.x release, 14.2.35, came with the December 2025 security update. Since then, advisories that also affect 13.x and 14.x have listed fixes only in 15 and 16, such as a denial of service in Server Components in January 2026 and remote code execution through image optimisation of SVG files in October 2026, which affects every version from 10.0.0 (that one also has a workaround: a fixed version of the sharp image library).

What React2Shell taught

On 3 December 2025, the React and Next.js teams disclosed a remote code execution flaw in React Server Components, CVE-2025-55182, rated CVSS 10.0, the highest possible score. It became known as React2Shell. A crafted request to a Server Function endpoint could run code on the server, with no sign-in needed. In Next.js, it affected apps using the App Router on 15.x and 16.x. Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime were not affected.

Three lessons from how it played out:

• There was no workaround. The Next.js advisory said upgrading to a patched version was required. Teams that could upgrade and deploy within a day were in a far better position than teams that first had to work out how.
• Exploits followed within a day. Vercel's React2Shell bulletin records public exploits from 4 December 2025, and CISA, the US government's cyber defence agency, added the flaw to its Known Exploited Vulnerabilities catalogue on 5 December, according to its NVD record. Next.js advised rotating every secret an app uses if it was online and unpatched on 4 December at 1:00 pm Pacific time.
• One patch was not the end. Researchers examining the fix found two more issues in Server Components, a denial of service and a way to read the compiled code of other Server Functions, and the first fix for the denial of service was incomplete. Teams that had just patched had to upgrade again.

Fixes now ship every month

The volume has not slowed. GitHub's list of Next.js advisories shows 51 advisories published between 1 January and 13 November 2026: 5 rated critical, 15 high, 28 medium and 3 low.

In July 2026, Next.js moved to a formal release programme for vulnerability fixes: roughly once a month, the Next.js blog announces the next scheduled release in advance, with its expected date and the highest severity it covers. Urgent fixes, and fixes for flaws already being exploited, still ship out of band. The most recent scheduled release, the November 2026 release on 3 November, shipped 16.4.5 and 15.5.29. In October, an out-of-band update fixed two critical remote code execution flaws.

In practice, a Next.js app now needs a small update most months, plus the occasional same-week fix. The cheap way to do that is to stay on a supported version and keep the upgrade path short.

Does hosting on Vercel protect you?

It helps, but it does not replace upgrading. In its React2Shell bulletin, Vercel says its firewall rules are an additional layer of defence that "cannot guarantee protection against all possible variants of an attack", and that upgrading to a patched version is the only complete fix. Some advisories only apply to self-hosted apps, such as two cache and response issues in the November 2026 release, and some have been blocked on Vercel by default, such as the 2025 middleware authorisation bypass. Neither changes the rule: the fix lives in your app's dependencies, wherever it runs.

How to check your app

1. Find the version. Run npx next info in the project folder, or look for the next package in your lockfile. Check the version your production deployment was built from, not just what is on the main branch.
2. Check the line is supported. 16.x is supported; 15.x until 31 January 2027; anything older is not.
3. Check it is the latest patch in that line. Compare it with the most recent release announced on the Next.js blog. A supported major on an old release is still exposed.
4. Note what the app uses. App Router or Pages Router, Server Actions, middleware (proxy in 16), image optimisation, and whether it is self-hosted. Each advisory says which of these it affects.
5. Check React too. React2Shell was a React flaw. On the App Router, Next.js uses its own build of React, so upgrading Next.js updates it; on the Pages Router, check that react and react-dom are on patched releases.
6. Make sure you will hear about the next one. Turn on GitHub's Dependabot alerts, or your platform's equivalent, for the repository, and have a named person who reads the Next.js security announcements.

If your app was generated by an AI tool such as v0, Lovable or Cursor, check it the same way. Its lockfile pins whatever was current the day it was built, and nobody may have looked at it since. If you want to know what else it needs before real users rely on it, our App Rescue Report is a fixed-price launch-readiness audit for apps built with AI tools.

What changes when you upgrade to Next.js 16

The official upgrade guide for version 16 lists every change. The ones that most often turn an upgrade into a project:

• Node.js 20.9 or later and TypeScript 5.1 or later. Node.js 18 is no longer supported, so the hosting and build pipeline may need to move first.
• Turbopack by default for development and builds. A custom webpack configuration, including one added by a plugin, makes the build fail until you migrate it or opt back into webpack.
• Async request APIs only. Synchronous access to cookies, headers, draftMode, params and searchParams, kept temporarily in 15, is removed.
• Middleware becomes proxy. The file and function are renamed, and proxy runs only on the Node.js runtime, so middleware that relies on the Edge runtime needs a decision rather than a rename.
• Image defaults are stricter. Among others, images from local IP addresses are blocked by default, only quality 75 is allowed unless configured, and remote image redirects are capped at three.
• Removals. AMP, the next lint command, and serverRuntimeConfig and publicRuntimeConfig are gone. Parallel route slots need an explicit default file.

Coming from 14, go through the version 15 guide as well: it requires React 19, makes request APIs async and stops caching fetch requests and GET route handlers by default.

Next.js provides codemods for much of this, and its guide now suggests running the upgrade with a coding agent. Whoever makes the edits, the guide's own checklist is clear that "a green build alone does not close runtime findings". The work that matters is testing what users do: signing in, paying, submitting forms, and pages that rely on caching.

A sensible upgrade plan

1. Patch first. Move to the latest release in your current supported line and deploy it. This is usually a small change and closes known issues while the bigger upgrade is planned.
2. Take stock. Node.js version, hosting, custom webpack configuration, middleware, image settings, and libraries that pin an older Next.js or React.
3. Put tests around what matters. Automated checks for sign-in, payments, forms and key pages, so the upgrade can be proved rather than hoped for.
4. Upgrade one major at a time, on a branch, with the codemods, then fix what they leave and test in a preview deployment.
5. Release, then keep the rhythm. Apply each Next.js fix release in the month it ships, and plan the next major before its support date, not after.

How Rocket Lab can help

Our senior engineers build, take over and upgrade web apps in React and Next.js. We designed and built the Before You Buy platform from scratch in React and Next.js, replacing an earlier MVP built offshore, and we built Visual Vectoring's web-based training simulator in Next.js and TypeScript on AWS.

If your app is behind, we can review where it stands, patch it, plan and run the upgrade, and keep it current afterwards. See our React and Next.js development page for upgrades and takeovers, and ongoing support and optimisation for keeping it current.

Frequently asked questions

Is Next.js 14 still supported?

No. Next.js 14 is listed as unsupported in the support policy. Its last release, 14.2.35, came out in December 2025, and fixes published since then for issues that also affect 14 have shipped only for 15 and 16.

When does support for Next.js 15 end?

The Next.js team will keep publishing fixes for Next.js 15 until 31 January 2027, extended from 21 October 2026. Until then, 15 gets only critical bug fixes and essential vulnerability fixes. Plan the move to 16 before that date.

Should we update 15 or go straight to 16?

Both, in that order. Moving to the latest 15.5 release is usually quick and closes known issues now. The upgrade to 16 takes longer, so plan it to land before 31 January 2027.

Was our Pages Router app affected by React2Shell?

Not by React2Shell itself, which affected the App Router on 15.x and 16.x. Pages Router apps are affected by other advisories, and Next.js recommended that they upgrade after the December 2025 follow-up issues too. Check each advisory against your version and the features you use.

Our app is hosted on Vercel. Do we still need to upgrade?

Yes. Vercel's firewall rules can block known attacks, but Vercel itself says they cannot stop every variant of an attack and that upgrading is the only complete fix.

How long does an upgrade to Next.js 16 take?

It depends on how far behind the app is and how much it uses middleware, custom webpack configuration, image settings and older libraries. A short review of the codebase is usually enough to scope it.

Talk to us about your app

• Talk to the team. Book a free 30-minute consultation and we will look at which version your app runs and what it would take to bring it up to date.
• Prefer a call back? Request a callback: leave your number and a time that suits you, and we will call you.