Next.js has scheduled a 30 September 2026 security release covering nine vulnerabilities. Here is what UAE ecommerce and portal owners should prepare, and what they can safely leave alone.
If your UAE ecommerce site or customer portal runs Next.js, identify its version and deployment owner before 30 September 2026. Do not rebuild the site because of this announcement. Prepare a controlled upgrade for the release, then test checkout, sign-in, forms and integrations before production deployment.
Next.js announced the planned release on 23 September 2026. It is scheduled to include versions 16.3.7 and 15.5.27. The announcement says it will address nine vulnerabilities: one critical, two high, five medium and one low. The detailed advisories, affected versions and upgrade instructions are due with the release itself. Read the Next.js announcement and keep the Next.js support policy with your technical records.
The useful decision for most owners is not whether to panic. It is whether someone can identify, test and deploy the correct patch.
This is advance notice, not the final security advisory. Next.js has told teams when the release is expected and which package versions it plans to publish, but it has not yet published the nine vulnerability details on the announcement page. That means an owner should avoid guessing which feature is affected or claiming that a particular customer system is exposed.
The supported release lines listed by Next.js are 16.x, described as Active LTS, and 15.x, described as Maintenance LTS. Active LTS receives new features, bug fixes, performance improvements and security patches. Maintenance LTS receives critical bug fixes and essential security updates. Older major versions, including 14.x and below, are listed as unsupported.
For a business, the practical point is simple. The number in the package file is not enough on its own. You also need to know whether the application uses the App Router or Pages Router, whether it is self-hosted or deployed through a hosting provider, and who can approve a production release.
The immediate change is operational rather than regulatory. A site handling orders, customer accounts, enquiries or portal access now has a known security maintenance date in its calendar. The owner needs evidence that the application was checked and, if affected, upgraded.
That evidence can be modest. Keep the current version, the planned target version, the test result and the deployment date in one record. If a developer or agency manages the site, ask them to confirm the running version in writing rather than assuming the version in a local project is the version serving customers.
A UAE retailer should also consider trading hours and campaign timing. An upgrade can affect payment callbacks, product search, stock feeds, Arabic pages, delivery integrations or analytics even when the security change itself is narrow. The risk is not a reason to delay indefinitely. It is a reason to test the journeys that produce revenue.
If the site is old enough to be on an unsupported Next.js major, this release may expose a wider maintenance problem. That does not automatically justify a rebuild. It does justify asking for a supported upgrade path, a documented exception or a separate replacement plan.
Do this when the 30 September release is published and its advisories are available. Until then, the sensible preparation is inventory, not speculative code changes. A developer should also check the application’s package lockfile and deployment pipeline, because updating a dependency locally does not change the version serving the live site.
For a business without an internal developer, this is where website and mobile app support may be relevant. The useful request is specific: version check, staging upgrade, business-flow testing and deployment record. It is not a request for a new website unless the existing application cannot be maintained safely.
If your site does not use Next.js, this announcement does not create a Next.js upgrade task. If your supplier confirms that the application is unaffected and the running version is supported, keep the confirmation and continue normal maintenance.
If you use a managed platform, ask what it patches automatically and what remains your responsibility. Do not treat hosting as proof that every application dependency is current. Equally, do not pay for a full rebuild simply because a security release has been announced.
The article Shopify 2026-04 API: UAE checkout and stock risks covers a different platform, but the same owner discipline applies: identify the live system, test the commercial workflow and keep a clear change record.
Paknology has a commercial interest if this review shows that your website or mobile app needs maintenance, an upgrade project or eventual replacement. A cheaper and simpler option is usually better when your existing developer can apply the patch, test the key journeys and document the result.
Before 30 September 2026, find the live Next.js version and the person responsible for deployment. After the advisory is published, upgrade only if your version is affected, then test the customer journeys before releasing the change.
Book a free consultation and get a clear roadmap — from company formation to a fully automated digital operation.