Next.js 15 Stops Getting Patches on October 21

Most teams read "LTS" and assume a comfortable runway. Next.js publishes a support policy that is shorter than it sounds, and the arithmetic is the part people get wrong.

Here is the position as of today. Next.js 16.x is Active LTS. Next.js 15.x is Maintenance LTS. Next.js 14.x and everything below it is unsupported. On 21 October 2026, 15.x joins 14.x, and a codebase running next@15 stops receiving security fixes from Vercel.

The two-year clock starts at release, not at maintenance

Read the policy text literally. Active LTS runs "from major version release until the next major version is released." Maintenance LTS runs "2 years following the initial major version release." Both windows are anchored to the same event: the day the major shipped.

That means Active LTS time is subtracted from the total, not added to it. Next.js majors have been arriving roughly annually, so in practice each version gets about one year Active and one year Maintenance. The history backs this out exactly:

Two years to the day, every time. The endoflife.date entry for Next.js lists the same dates independently, and 14.x's last release was 14.2.35 on 11 December 2025 — a straggler roughly six weeks past its EOL. The policy does reserve the right to patch outside the window in "exceptional circumstances based on bug severity" — do not plan around exceptions.

The practical consequence: if Next.js 17 ships in October 2026 as the annual cadence suggests, 16.x drops into Maintenance with only one year left on its clock, not two. Budget your upgrade cycle at twelve months, not twenty-four.

What Maintenance LTS actually covers

Active and Maintenance are not two flavours of the same thing. Active LTS gets new features, regular bug fixes, performance improvements and security patches. Maintenance LTS gets "critical bug fixes only" and "essential security updates." A non-critical bug you hit on 15.x today will not be fixed on 15.x. It will be fixed on 16.

One line in the policy deserves more attention than it gets: Maintenance updates "land as semver-minor releases (even if they contain breaking changes)." Your lockfile pins an exact version, so this is not an automatic footgun — but any CI job that resolves ^15.5.0 fresh can pick up a breaking change inside a minor bump. Pin the range or commit the lockfile. This is the same class of problem that makes registry and CI hygiene worth getting right before you need it.

The last scheduled patch lands three weeks before the door closes

Next.js announced on 23 September that a scheduled security release is coming on 30 September 2026, shipping 16.3.7 and 15.5.27. It addresses nine vulnerabilities: one critical, two high, five medium, one low.

That is the pattern all quarter. On 22 September an out-of-band critical upstream fix produced 16.3.6 and 15.5.26. On 25 August, 16.3.3 and 15.5.24 addressed two critical-severity issues. Vercel has been shipping paired patches reliably — and on 21 October, the 15.x half of each pair stops.

Nine vulnerabilities in a single scheduled release, on a framework that patched two criticals the previous month, is not a quiet codebase. Sitting on an unpatched 15.x through November is a materially different risk posture than sitting on it today.

What upgrading to 16 actually costs

Start with the floor requirements, because they gate everything else. Next.js 16 needs Node.js 20.9.0 or later — Node 18 is out — and TypeScript 5.1 or later. Browser support moves to Chrome, Edge and Firefox 111+ and Safari 16.4+. If your runtime is pinned below those, the framework upgrade is the second problem, not the first. Teams still working out their Node floor should read what the current Node releases changed before picking a target.

The mechanical part is a codemod:

npx @next/codemod@canary upgrade latest

It rewrites next.config for the promoted turbopack key, migrates next lint to the ESLint CLI, renames the middleware convention to proxy, and strips unstable_ prefixes from stabilised APIs. It does not run every migration. If you still use synchronous params, searchParams, cookies(), headers() or draftMode() — the compatibility shim 15 allowed — run next-async-request-api as well. Synchronous access is fully removed in 16.

The changes a codemod cannot make for you

Turbopack is the default for both next dev and next build. If your project has a custom webpack config, the build fails deliberately rather than silently ignoring it; you either migrate the config, pass --turbopack to ignore it, or opt out with --webpack. Note that a plugin can add a webpack config you did not write.

Then the removals: serverRuntimeConfig and publicRuntimeConfig are gone, AMP support is gone, every parallel route slot now requires an explicit default.js or the build fails, and proxy does not support the edge runtime at all — it is Node-only and not configurable. Six next/image defaults changed too, including minimumCacheTTL going from 60 seconds to four hours and qualities narrowing to [75].

None of this is exotic. It is a week of work on a medium app and an afternoon on a small one. The cost is real but bounded — which is exactly why letting it slide past October is the wrong trade.

If you cannot move by 21 October

Take 15.5.27 on 30 September, pin it, and treat the gap as a tracked risk rather than an oversight. Write down who is watching Vercel's advisories, what your rollback looks like, and the date you will actually do the upgrade. An expired framework with an owner and a date is survivable. An expired framework nobody has thought about since a scheduled dependency bump is not.

Third-party extended-support vendors exist for EOL JavaScript frameworks. They are a commercial contract, not a Vercel product, and they cost money — evaluate them the way you would any other tooling purchase, on what they actually commit to patching and how fast.

The broader lesson generalises past Next.js. Every framework and runtime in your stack has a support window, most of them are shorter than the marketing implies, and almost none of them will email you. Pull the EOL dates for your core developer tooling and deployment stack into the same calendar you use for certificate expiry. For open-source dependencies without a formal policy, the last commit date is the support window.

FAQ

What is the exact Next.js 15 end-of-life date?

21 October 2026, two years after 15.0 shipped on 21 October 2024. After that date Next.js 15.x receives no further security or bug patches under the support policy.

Does Maintenance LTS mean two more years on top of Active LTS?

No. The policy measures both windows from the major version's original release date, so Active and Maintenance together total two years. Next.js 14 confirms it: released 26 October 2023, EOL 26 October 2025.

What is the last Next.js 15 release?

The last one announced is 15.5.27, scheduled for 30 September 2026 as part of a nine-vulnerability security release. Further 15.x patches before 21 October are possible but not announced.

Will a bug I report on 15.x get fixed?

Only if it is critical. Maintenance LTS covers critical bug fixes and essential security updates. Ordinary bugs are fixed on the Active LTS line, currently 16.x.

What are the minimum versions for Next.js 16?

Node.js 20.9.0 and TypeScript 5.1.0. Node 18 is no longer supported. Browser targets move to Chrome, Edge and Firefox 111+ and Safari 16.4+.

How long will Next.js 16 be supported?

Until 21 October 2027 on the same two-year rule, assuming the policy holds. It stays Active LTS until Next.js 17 ships, then moves to Maintenance for whatever remains of the two years.

Check the support window before you pick the version, not after the patches stop.