Next.js Just Shipped Two Critical RCEs. If You Self-Host, Patch Today.

Vercel moved the Next.js security release forward a day. That's the part worth paying attention to.

They'd already flagged a patch window. Then they found a second critical in an upstream dependency and decided people shouldn't wait until August 26. GitHub tagged v16.3.3 and v15.5.24 on August 25. Both close two unauthenticated remote code execution bugs. Not one.

If you self-host Next.js, this is a lockfile-and-redeploy job, not a "we'll catch it in the next sprint" note.

What actually shipped

Two patched lines:

npm install next@15.5.24  # 15.x Maintenance LTS
npm install next@16.3.3   # 16.x Active LTS

The GitHub release notes (published by Sebastian Silbermann / eps1lon) point at the same pair of advisories on both tags:

• Unauthenticated RCE in the Image Optimization API when AVIF is involved — GHSA-2xp9-vwfh-vxw4
• Unauthenticated RCE on Windows-hosted servers — GHSA-p293-qw3h-jr36 / CVE-2026-75604

The official Next.js post is short. That's usual for these. The details live in the advisories.

The AVIF path: your optimizer is the attack surface

Next.js doesn't decode AVIF itself. sharp does. sharp talks to libheif. A heap overflow in that library (also tracked as GHSA-g89c-p67h-r497) is reachable when the Image Optimization API handles an attacker-controlled AVIF.

You don't need a logged-in user. If the optimizer will fetch or accept an image you don't fully control — remote src, user uploads, a CMS that allows AVIF — that's the setup.

The patched Next.js releases turn AVIF optimization off until a fixed libheif makes it through the stack. That's a product trade-off: you lose automatic AVIF transcoding for a while. Fine. RCE is worse.

Don't assume "we only use WebP" saves you if something in the pipeline still accepts AVIF and hands it to the optimizer.

The Windows path: mixed routers, no Cache Components

CVE-2026-75604 is narrower and meaner in a different way.

Vercel's post: apps using both the Pages Router and the App Router without Cache Components, on a Windows filesystem, can hit unauthenticated RCE. Linux and macOS are called out as not affected. They also say there's no known workaround for affected Windows-hosted apps.

So: IIS, some Azure App Service Windows workers, a Windows VM behind IIS/ARR, that one internal box someone stood up in 2023. If that's you and you're on mixed routing, you patch. There isn't a clever next.config toggle in the official writeup.

If you only run Linux containers, this specific CVE isn't your fire. The AVIF one still might be.

Patching is boring on purpose

# confirm what you think you're running
npx next --version

npm install next@16.3.3
# or: npm install next@15.5.24

Then actually ship it. A package.json bump that never hits production is not a patch.

Rebuild the image. Recycle the process. Check the version string in the running container, not just CI logs. Writeups after the release keep repeating that because people forget it every time.

If you pin sharp yourself, look at what Next.js now ships. Fighting the framework's disable-AVIF change by re-enabling formats in config is a good way to put the hole back.

What this doesn't mean

It doesn't mean Next.js is uniquely cursed. Image pipelines and path handling on Windows are old failure modes. The interesting bit is the disclosure window: they already had a date, then a second critical showed up upstream, and they pulled the release forward so you only upgrade once.

It also doesn't mean you should rewrite the app this weekend. Upgrade. Confirm. Then read the advisories if you mix App Router and Pages on Windows, or if you optimize untrusted images.

Vercel's Open Source Bug Bounty is how a lot of this gets found. Questions on their program still go to security@vercel.com, per the post.

If your Next.js is sitting on a VPS or a Windows host you haven't touched since the last minor, start with the install commands above. The blog post is two screens. The incident is not.

---