Next.js moves to scheduled security releases

Vercel is instituting a monthly, pre-announced security release program for Next.js after a series of high-severity issues — notably React2Shell (CVE-2025-55182), a CVSS 10.0 pre-auth RCE that was actively exploited at scale, and a CVSS 9.1 authorization bypass — exposed hundreds of thousands of instances and attracted both opportunistic criminals and state-affiliated actors; the scheduled cadence aims to improve patch planning, partner mitigation (WAF rules, hosting protections), and coordinated disclosure.