Next.js • 8 min
Next.js Just Shipped Two Critical RCEs. If You Self-Host, Patch Today.
Next.js 16.3.3 and 15.5.24 close two unauthenticated RCEs: AVIF image optimization via libheif, and a Windows-only Pages+App Router bug. What actually changed on August 25.
8/30/2026Read More →