Hypothesis and scope
Two Next.js releases on the same day, September 22, 2026: v16.3.6 and v15.5.26. The question I'm interested in answering isn't which one is "better," but something more operational: does the 15.x branch still get only security patches, or does it also get general features and fixes? If the answer is "security only," the criteria for deciding when to migrate changes completely.
This isn't a benchmark or a performance measurement. It's a direct reading of the official release notes on GitHub, comparing the text content of each tag. Scope is limited: a single pair of releases, a single day. I can't generalize about the full lifecycle of the 15.x and 16.x branches from a single sample — that's flagged as a limitation below.
What each release note says
Primary source, no interpretation in between:
v16.3.6 — published September 22, 2026 at 17:15 UTC by maintainer eps1lon. The full text of the release reads:
"This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse"
Nothing else. A single item, one vulnerability identified by its GHSA code, affected component: next/og ImageResponse.
v15.5.26 — published the same day, one minute earlier (17:14 UTC), same maintainer. The full text:
"This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026"
Also a single item. Same component (next/og), same day, but the wording is different: "security hardening" instead of "security fix" with a specific GHSA. The 15.5.26 release note points to a Next.js blog post for more context, which isn't part of the material I could verify for this analysis — I'm not going to speculate about its content.
Direct comparison
| v16.3.6 | v15.5.26 | |
|---|---|---|
| Publish date | Sep 22, 2026, 17:15 UTC | Sep 22, 2026, 17:14 UTC |
| Affected component | next/og ImageResponse | next/og |
| Nature of the change | Specific fix with identified GHSA (RCE) | Additional "hardening," no own GHSA in the text |
| Number of changelog items | 1 | 1 |
| New features in this tag | Not mentioned | Not mentioned |
| Commits from this tag to canary | 858 | 5556 |
The last data point in the table — commits from the tag to canary — doesn't measure development speed or future activity: it's just the current distance between that specific tag and the tip of canary at the moment GitHub was checked. I'm including it because it's public data visible on the release page, not because it predicts anything about the pace of either branch.
What I CANNOT conclude with this evidence
This pair of releases isn't enough to say whether 15.x receives only security patches as a general policy. The two texts I have in front of me are specifically about next/og, on the same day, probably coordinated as a response to the same vulnerability reported across different branches. That's consistent with "15.x gets security backports," but it doesn't prove that's all it gets: it would take reviewing several previous releases in the 15.5.x series to see if general bugfixes without a security component ever went in.
Nor can I state, with these two tags, what new features 16.3.6 brings compared to 15.5.26 in terms of product: neither text mentions features. If the 16.x branch has accumulated new functionality in other patches within the 16.3.x series, it's not documented in this specific release — reviewing the full changelog from 16.3.0 to 16.3.6, not just the last tag, would be necessary.
What this means for a team that hasn't migrated to App Router 16
With the evidence I have — just these two releases — the prudent criterion is this: if the team is still on 15.5.x and applied the next/og patch, it's covered for this specific vulnerability. That confirms Vercel keeps the 15.x branch alive for security, at least in this concrete case. What it doesn't confirm is that teams can stay there indefinitely waiting for the next fix: there's no evidence in these two tags about how much longer the 15.5.x series will receive support, or whether it will incorporate anything beyond security hardening.
The decision to force a migration to App Router 16 doesn't depend on this specific patch — it depends on which 16.x features the project needs and how much support time 15.x has left, a detail that isn't in these release notes.
Pending protocol for anyone who wants to dig deeper
I didn't run this as part of this analysis; I'm leaving it as reproducible steps for anyone who wants to go beyond the two specific tags:
# View the full release history of 15.5.x from npm
npm view next versions --json | grep '"15\.5\.'
# Compare the code diff between two specific tags
git log v15.5.20..v15.5.26 --oneline -- packages/next/src/server/image-optimizer
# Check whether any 15.5.x release brings features (not just fixes)
# by searching for the term "Feature" in each GitHub release noteCriterion for accepting or rejecting the hypothesis "15.x only receives security": if reviewing 5 or 6 previous releases in the 15.5.x series turns up an item that isn't a security fix or a critical bugfix, the hypothesis falls apart. With the two tags in this analysis, there isn't enough evidence either way — just a single data point from September 22, 2026.
Original source:
- Next.js v16.3.6 release: https://github.com/vercel/next.js/releases/tag/v16.3.6
- Next.js v15.5.26 release: https://github.com/vercel/next.js/releases/tag/v15.5.26
Looking for this approach on your team?
Explore my technical case studies or discuss a senior role, architecture and technical leadership.
Related Articles
Claude API Key Security: Why .env Is Not Optional
Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.
Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic
The gap between your Server Action and your UI has a name: setQueryData
The Server Action resolves, the toast says "saved," and the UI still shows the old data for a beat. That beat is the gap setQueryData closes without waiting for the full server roundtrip.
Sep 08 2026 · 7′ · Tutorials · Next.js · React
revalidatePath is brute force, revalidateTag is precision
I confused revalidatePath with revalidateTag on a small project and ended up invalidating pages that had nothing to do with the change. Here's the real difference between the two cache granularities in Next.js 16, with a decision checklist.
Sep 04 2026 · 7′ · Tutorials · Next.js · React
Comments (0)
What do you think of this?
Drop your comment in 10 seconds.
We only use your login to show your name and avatar. No spam.
No comments yet. Be the first — your take matters most when we're few.