The short answer: Next.js 15 leaves Maintenance LTS on 21 October 2026, two years after its release, and from then on Next.js commits to no further fixes for it. The upgrade to Next.js 16 is usually a few days of work, not a rebuild. Move to a supported Node.js version first, run the official codemod, then sweep for the synchronous
params,cookies()andheaders()access that Next.js 16 removes. Then check the changes that don't fail the build at all: image caching and quality defaults, linting, and smooth scrolling. Those are the ones that reach production unnoticed.
If your site or product runs on Next.js 15, this is the last month it gets security patches. As of 9 October 2026 the newest 15.x release is 15.5.27, published on 30 September. Next.js has also announced an out-of-band security update for 14 October covering two critical and one high-severity vulnerabilities in upstream dependencies, without yet saying which versions it will patch.
"End of support" has a specific meaning under Next.js's own long-term support (LTS) policy. A major version is in Active LTS until the next major ships, and in Maintenance LTS after that.
What does end of support actually mean?
Next.js's support policy says each major version "will remain in Maintenance LTS for two years following the initial release". During that time, Next.js commits to "only critical bug fixes and essential security updates".
| Version | Released | Status on 9 October 2026 | Support ends |
|---|---|---|---|
| Next.js 16 | 21 October 2025 | Active LTS: features, fixes, security | 21 October 2027 (Maintenance LTS once Next.js 17 ships) |
| Next.js 15 | 21 October 2024 | Maintenance LTS: critical and security fixes only | 21 October 2026 |
| Next.js 14 and older | — | Unsupported | Already ended |
The policy leaves one door open: "In rare circumstances, depending on the severity of the underlying bug, we will patch versions of Next.js that are outside of our LTS policy." That is a reason not to panic on 22 October. It is not a plan. A severe vulnerability found in November may or may not be patched for 15, and you won't know until the advisory lands.
The cost of staying shows up later. The September 2026 releases fixed a critical remote-code-execution flaw in next/og that took one advisory and one upgrade to close. On an unsupported version, that one-line fix might never come. The September security releases are a good illustration of how fast those weeks move.
Is upgrading to Next.js 16 a big job?
For most App Router sites, no. Next.js 16 is mostly a clean-up of things Next.js 15 already deprecated. The biggest change, async request APIs, was introduced in 15 with a temporary synchronous fallback. Next.js 16 removes the fallback.
What decides the size of the job:
- How much code still reads
params,searchParams,cookies()orheaders()synchronously. The codemod handles most of it. - Whether you have middleware. It is renamed to
proxyand runs on the Node.js runtime, so Edge-specific middleware needs thought. - Whether you have a custom webpack configuration. Turbopack is now the default bundler for
next build. - Whether you use AMP or
serverRuntimeConfig/publicRuntimeConfig. Both are removed.
A marketing site with no middleware and no custom webpack config is often a day's work. An app with heavy middleware, custom webpack loaders and cache tagging takes longer. Still, it is a sprint, not a rebuild. If you are weighing a rebuild anyway, decide that separately. When to rebuild versus refactor is a different decision from a version bump.
How to upgrade from Next.js 15 to 16
1. Fix the Node.js version first
Next.js 16 needs Node.js 20.9 or later. Node.js 20 itself reached end of life on 30 April 2026, so upgrading to Node 20.9 just swaps one unsupported runtime for another. Use Node.js 22, maintained until April 2027, or Node.js 24, in long-term support until April 2028. Set it in your host's settings, in CI, and in package.json engines. TypeScript must be 5.1 or later.
2. Run the codemod on a branch
npx @next/codemod@canary upgrade latest
According to Next.js's upgrade guide, the codemod updates next.config.js for the new top-level turbopack option. It also migrates next lint to the ESLint CLI, renames middleware to proxy, and removes unstable_ prefixes from stabilised APIs. Upgrade react, react-dom, @types/react and @types/react-dom alongside.
3. Sweep for synchronous request APIs
The upgrade codemod doesn't catch every synchronous access. Run the dedicated one too:
npx @next/codemod@canary next-async-request-api .
Then search for anything it marked. In Next.js 16, params and searchParams are Promises in pages, layouts and route handlers. So are params in opengraph-image, twitter-image, icon and apple-icon. cookies(), headers() and draftMode() must be awaited too.
4. Build, then check what the build doesn't
Run next build. Failures here are the easy part: missing default.js in parallel routes, a custom webpack config, removed AMP or runtime-config APIs, revalidateTag without a cache profile. Fix them and move on to the next section, which is where upgrades go wrong.
5. Deploy to a preview and test the real pages
Click through the pages that earn money, share a link to see the social card, and submit every form. On a site that matters, compare the preview with production side by side before you promote it.
The changes a green build won't catch
These change behaviour without an error. Every one of them comes from the "behavior changes" and "removals" lists in the Next.js 16 release post:
| Change in Next.js 16 | What you'll notice | What to do |
|---|---|---|
images.qualities defaults to [75] only | A quality={90} hero image is quietly served at 75 | Add the qualities you use to images.qualities |
images.minimumCacheTTL goes from 60 seconds to 4 hours | An updated image keeps showing the old version for hours | Set a lower value if your images change often |
images.imageSizes drops 16 | Usually nothing; tiny icons may get a larger file | Add 16 back if you rely on it |
images.maximumRedirects goes from unlimited to 3 | A remote image behind a redirect chain stops loading | Fix the source URL or raise the limit |
next build no longer runs linting | Lint errors stop blocking deploys | Add an explicit lint step to CI |
| Smooth scrolling is no longer overridden on navigation | Route changes scroll slowly to the top | Add data-scroll-behavior="smooth" to <html> |
| Build output drops "First Load JS" sizes | The bundle-size number your team watched disappears | Measure with Lighthouse or real-user metrics instead |
Synchronous params in a metadata image route can belong on that list too. On this site, the social-card routes for blog posts read params.slug without awaiting it. Type-checking passed and the build passed, but every card showed a generic title instead of the page's own. Nobody noticed until a link was shared and someone looked at the card. The September security post has the detail. The fix was one await.
Should you wait for Next.js 17?
No. Next.js 17 has no announced date as of 9 October 2026, though Next.js 13, 14, 15 and 16 all shipped in late October. Even if 17 arrives this month, it will be a fresh major with its own breaking changes. Meanwhile 16 stays supported until 21 October 2027, two years from its own release.
Next.js 16.4, released on 6 October 2026, recommends Cache Components for every app and says the model "will become the default in Next.js 17". So 16 is the stepping stone to 17 either way. You don't have to adopt Cache Components to upgrade to 16. Next.js's guide treats it as a separate migration, and doing it on a supported version is far calmer than doing it under a deadline.
Common questions
When does Next.js 15 stop getting security updates?
On 21 October 2026, two years after its 21 October 2024 release, when it leaves Maintenance LTS. After that, Next.js commits to no further fixes for version 15, although its policy reserves the right to patch versions outside LTS in rare, severe cases.
Is the latest Next.js 15 release safe to stay on?
As of 9 October 2026 the latest is 15.5.27, released 30 September. It carries the September security fixes. Next.js has announced another security update for 14 October and hasn't said which versions it covers. After 21 October, staying on 15 means accepting that future fixes may not come.
How long does upgrading from Next.js 15 to 16 take?
For a typical App Router marketing site with no middleware or custom webpack configuration, often a day including testing. Apps with heavy middleware, custom webpack loaders, AMP or runtime configuration take longer, but it is still a refactor measured in days, not a rebuild.
What Node.js version does Next.js 16 need?
Node.js 20.9 or later, and TypeScript 5.1 or later. Node.js 20 itself reached end of life on 30 April 2026, so use Node.js 22, maintained until April 2027, or Node.js 24, in long-term support until April 2028.
What breaks when upgrading to Next.js 16?
Builds fail on synchronous request APIs, missing parallel-route default files, custom webpack configs, AMP and runtime config. Behaviour changes without failing on image quality and caching defaults, linting during builds, and smooth scrolling. Test those on a preview deployment before promoting.
The honest summary
Next.js 15's end of support is a real deadline, but a small job. Upgrade Node first, run both codemods, build, and spend most of your time on the changes that don't throw errors. Do it before 21 October, or at least before the next critical advisory gives you a much worse deadline.
If the upgrade is wrapped up in bigger questions about how the product is built, that is what a web architecture consultant is for. The App Router patterns that hold up in production are worth a read while you have the code open.
Sources: Next.js support policy · Next.js 16 release post (21 October 2025) · How to upgrade to version 16 (Next.js docs) · Next.js 16.4 (6 October 2026) · Upcoming Next.js security update (8 October 2026) · Node.js release schedule
Written by Jagatjeet, a web architect and digital marketer based in Kamloops, BC. Jagatjeet (jagatjeet.com) builds and maintains Next.js sites and advises teams on web architecture. Published 9 October 2026.