Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.