The Vercel Bug Bounty Program enlists the help of the hacker community at HackerOne to make Vercel more secure. HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited.

The September 2026 security release for Next.js is now available

Next.js is preparing a scheduled September security release for September 30, 2026.

The September 22, 2026 out-of-band security update for Next.js is now available

Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.

How the Next.js team used an agent to research old reports and work through the issue backlog.

Turbopack’s chunking speeds up page loads and enables sharing code across pages. We shipped new experimental features to improve chunking in Next.js 16.3.

Production grade React applications that scale. The world's leading companies use Next.js by Vercel to build static and dynamic websites and web applications.

The August 2026 security release for Next.js is now available

Production grade React applications that scale. The world's leading companies use Next.js by Vercel to build static and dynamic websites and web applications.

Next.js is moving the August security release forward to August 25, 2026.

Production grade React applications that scale. The world's leading companies use Next.js by Vercel to build static and dynamic websites and web applications.

Next.js is preparing a scheduled August security release for August 26, 2026.

Build app-like experiences with Instant Navigations, server-rendered data, optimistic updates, and live client state in Next.js 16.3.

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side…

The case study behind Instant Navigations in Next.js 16.3, and how we made v0's navigations instant using tests and a coding agent.

The July 2026 security releases for Next.js are now available

Next.js is moving to a formal security release process

Turbopack in Next.js 16.3 adds development memory eviction, persistent file cache for builds, experimental Rust React Compiler, and `import.meta.glob` support.

Actionable errors with paste-ready fix prompts, first-party Skills for the dev loop and Cache Components, and tooling that keeps coding agents in sync with your project.