Next.js 15 Is End of Life: Upgrade to 16 Now?
Next.js 15.x (released 21 Oct 2024) leaves Maintenance LTS on 21 Oct 2026 per nextjs.org/support-policy. Active LTS is 16.x. Points to September 2026 patches 16.3.8 / 15.5.27. No exploit steps; nothing tested; no affiliate.
4 min read
Summary
Next.js 15 Maintenance LTS ends 21 Oct 2026: what to check before then
Next.js 15 reaches end of life on 21 October 2026: under Vercel's published support policy each major stays in Maintenance LTS for two years after release, and 15.x shipped on 21 October 2024. Until then 15.x gets only critical bug fixes and essential security updates (the latest is 15.5.27 from 30 September 2026), so patch to 15.5.27 now and plan the move to 16.x, the current Active LTS.
There is no affiliate link in this article.
Related links
- 01shoppercove.com/blog/nextjs-16-3-8-security-release-2026
- 02shoppercove.com/blog/nextjs-16-app-router-production-checklist-2026
- 03shoppercove.com/blog/react-19-3-view-transitions-fragment-refs-2026
What “Maintenance LTS” means here
From the support policy:
- Active LTS (currently 16.x, released Oct. 21, 2025) gets new features, regular bug fixes, performance work, and security patches.
- Maintenance LTS (currently 15.x, released Oct. 21, 2024) gets only critical bug fixes and essential security updates.
- Each major remains in Maintenance LTS for two years after the initial release.
- For Maintenance LTS, updates can land as semver-minor releases even when they include breaking changes.
- Outside that window, Next.js may still patch in rare, severe cases—but that is the exception, not a plan you should rely on.
So if you are still on 15.x after 21 October 2026, you should assume you are off the normal security-update train unless Vercel says otherwise for a specific emergency.
Where 15.x stands as of late September 2026
The September 2026 security release shipped patches to:
- v16.3.8 (Active LTS)
- v15.5.27 (Maintenance LTS)
Vercel’s post lists several CVEs across image optimization SSRF, cache-poisoning paths for self-hosted SSG/ISR, App Router metadata image routes, Cache Components / 'use cache' issues, and a low-severity next dev MCP endpoint issue. The post also states which setups are not affected for some items (for example, no images.remotePatterns for the image SSRF case; Vercel-hosted apps for one cache-poisoning case; Turbopack builds for the metadata dynamicParams issue).
ShopperCove is not reproducing any of those issues. If you run Next.js, read the advisory, match your hosting and router setup to the impact notes, and patch—do not wait for a walkthrough of the bugs.
As of the endoflife.date snapshot updated 1 October 2026, 15.5.27 (30 Sep 2026) is listed as the latest 15.x build, with security support ending 21 Oct 2026.
Practical checklist before 21 October
- Confirm your version:
npx next --version(or checkpackage.json/ lockfile). - If you are on 15.x: plan the move to 16.x Active LTS (policy table names 16.x as Active). Prefer a current patched line such as 16.3.8+ rather than an older 16.x build.
- If you must stay on 15.x briefly: at least land 15.5.27 (or newer 15.x if one appears) before the window closes, knowing Maintenance LTS ends on the 21st.
- Read the September advisory impact section against your stack: App Router vs Pages Router, self-hosted vs Vercel, webpack vs Turbopack, Cache Components / Draft Mode, and whether
images.remotePatternsis set. - Self-hosted operators: pay extra attention to the SSG/ISR cache-poisoning notes in the September post; Vercel’s write-up calls out self-hosted Pages Router SSG/ISR for one medium issue and says applications on Vercel are not affected for that item.
- Do not treat canary as production. The support policy says canary is for experimentation, not production traffic.
Why ShopperCove is covering this now
Mid-October is late to discover that a client still ships next@15.4 on a VPS. The policy date is fixed and public. Pair this note with the earlier ShopperCove write-up on the 16.3.8 / 15.5.27 security release if you need the CVE list in one place.
Bottom line
21 October 2026 is the scheduled end of Next.js 15.x Maintenance LTS under the published two-year rule. Active LTS is 16.x. Patch first, then upgrade. Primary wording lives on nextjs.org/support-policy and the September 2026 security release.
FAQ
When is Next.js 15 end of life?
21 October 2026, two years after its 21 October 2024 release, per nextjs.org/support-policy. endoflife.date lists the same security-support end date.
What is the latest Next.js 15 version?
15.5.27, released 30 September 2026 with the September security fixes.
What happens after 21 October 2026?
Assume you are off the normal security-update train. The policy says Next.js may patch older versions only in rare, severe cases, so upgrade to 16.x Active LTS (16.3.8 or newer).
Sources
Lab evidence
What I found running this
Sources read 5 Oct 2026 via WebFetch: nextjs.org/support-policy, september-2026-security-release, endoflife.date/nextjs. No app upgraded or scanned. Next.js 15.x (released 21 Oct 2024) leaves Maintenance LTS on 21 Oct 2026 per nextjs.org/support-policy. Active LTS is 16.x. Points to September 2026 patches 16.3.8 / 15.5.27. No exploit steps; nothing tested; no affiliate.
Explore the product
Untested by us, and no traffic result is guaranteed. Check the live offer and refund terms first.
AI Traffic Secrets for AI-era SEO
See AI Traffic Secrets detailsReady Client Sites for prebuilt websites
See Ready Client Sites detailsKeep reading
When Does Next.js 16 Reach End of Life? Support Dates
How the Next.js support policy applies to version 16.
Summary12 Oct 20261 min read
When Does Django 5.2 LTS End? Support Until April 2028
The official support dates for Django's current long-term support release.
Summary12 Oct 20261 min read
When Is Node.js 22 End of Life? April 2027
Node 22 still gets critical fixes, but only until April 2027. Node 24 moves to maintenance this month and Node 26 becomes LTS on 28 October.
Summary11 Oct 20262 min read
