The security drop Vercel flagged last week is now live. Next.js 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS) went out on August 25 — pulled forward a day from the scheduled 26th — and together they fix two critical-severity vulnerabilities, with the full advisory published alongside the tags. A second patch is still on the calendar for the 26th to clean up one more critical issue. If you run either supported line in production, take the upgrade now rather than waiting for the follow-up; the criticals are the kind you don't sit on, and both releases are drop-in for their respective majors.