Next.js is moving from ad hoc patches to a predictable security-release schedule, so teams now get a planning window instead of a surprise patch drop. The standard response of waiting for CVE details at release time misses that mitigations and upgrade work can start before the exact flaw is public.
Vercel says it will post advance notice about expected security releases about once a month, including the date and the highest severity level, then publish CVE details after the patches land. The first scheduled release is July 20, and it covers Next.js 16.2 and 15.5 with fixes for 4 high and 5 medium vulnerabilities.
Urgent fixes and issues under active exploitation will still ship outside the monthly cadence. The shift puts Next.js closer to the release discipline already used by Django, Node.js, Kubernetes, and OpenSSL, which matters for teams that coordinate deployments and defenses around framework release windows.