Vercel Discloses April 2026 Security Incident (Unauthorized Access to Internal Systems)

Vercel officially disclosed an unauthorized access incident affecting some internal systems in April 2026.

The incident is currently under investigation, with response support from external security experts, and law enforcement has also been notified.

The scope of impact was not the entire customer base but limited to a limited number of customers, and Vercel is engaging with those customers individually and directly.

• Platform services remain operating normally
• This is not a large-scale service outage but an incident involving internal system compromise
• Users are advised to review their environment variables
• In particular, using protection features for sensitive env vars is important

The Vercel ecosystem has recently seen an expanding attack surface due to framework vulnerabilities, large-scale attack attempts, and phishing abusing Vercel domains, and this incident once again highlights the risk of secrets management.