The team posted a heads-up: an out-of-band release on Wednesday, October 14, covering two Critical and one High-severity issue that live in upstream dependencies rather than in Next.js itself. Two of the three fixes slipped from the September security release while the upstream maintainers coordinated. No CVE IDs or affected version ranges yet — those land with the patch. There's nothing to do until Wednesday, but if you ship Next.js in production, keep an eye on the blog that morning so you can upgrade the moment the advisories drop. Critical-in-a-dependency is still critical in your app.