Next.js Patches Two Unauthenticated RCEs in a Single Release

Next.js shipped its August 2026 security release a day early, on August 25, after finding a second critical, unauthenticated remote-code-execution bug while preparing the first. The result is 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS), closing two separate CVSS-9-plus flaws in the same patch (Next.js blog, August 2026 Security Release).

---

What changed

The more severe of the two, tracked as GHSA-2xp9-vwfh-vxw4 with a CVSS v4 score of 9.5, sits in libheif, the library Next.js’s Image Optimization API uses via sharp to decode AVIF files. A crafted AVIF containing nested identity-derivation and auxiliary item references can make the decoder allocate an 8-bit alpha-channel buffer, then write 16-bit samples from a second alpha entry into it, overflowing the allocation by roughly 16 KB and enabling remote code execution with no authentication required. The underlying libheif bug (GHSA-g89c-p67h-r497) affects every version through 1.23.1, which pulls in Next.js 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. Because there’s no upstream libheif fix yet, the patched Next.js releases don’t fix the decoder. They disable AVIF optimization entirely until one ships (GitHub Security Advisory GHSA-2xp9-vwfh-vxw4).

The second, CVE-2026-75604 (GHSA-p293-qw3h-jr36, CVSS 9.0), is narrower but still unauthenticated RCE: it hits apps that use both the Pages Router and the App Router without Cache Components, and only when the Next.js server itself runs on a Windows filesystem. Linux and macOS deployments aren’t exposed. It covers Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2, and there’s no workaround short of upgrading: the fix ships only in 15.5.24 and 16.3.3 (GitHub Security Advisory GHSA-p293-qw3h-jr36).

Vercel’s own changelog told customers the platform already handles both: deployed apps get the AVIF mitigation and the patched runtime automatically, with no redeploy required (Vercel changelog, August 25, 2026). Netlify, which hosts Next.js apps but doesn’t maintain the framework, published a same-day explainer pointing customers at the two version numbers and telling anyone self-managing their build to upgrade (Netlify changelog, August 25, 2026).

---

Why this matters

Two unauthenticated RCEs in one release is a heavier release than Next.js’s now-monthly security cadence usually produces (Firerun, July 26, 2026). Most months land denial-of-service or SSRF bugs, not code execution reachable without a login. Bumping the release date by a day because a second critical bug turned up mid-preparation is the program working as designed: the schedule is a floor, not a ceiling, and an active critical finding jumps the line.

The AVIF bug is also a reminder that a framework’s attack surface isn’t only its own code. libheif is a third-party image library two dependency hops from next.js, and its bug forced Next.js to ship a mitigation (disabling a feature) rather than a fix, because the fix isn’t upstream yet. Any app processing user-uploaded images through a similar chain has the same exposure until the library itself patches.

For most Vercel-hosted teams this is close to a non-event: the platform absorbed both fixes without a customer action. For everyone else (self-hosted, Windows-based builds, or any host besides Vercel and Netlify), this is a same-day upgrade, not a routine one.

Key Takeaways

• Next.js 16.3.3 and 15.5.24, released August 25, 2026, fix two unauthenticated RCE vulnerabilities, both CVSS 9.0 or higher.
• GHSA-2xp9-vwfh-vxw4 (CVSS v4 9.5) is a libheif heap overflow reachable through AVIF image optimization; patched releases disable AVIF optimization since no upstream fix exists yet.
• CVE-2026-75604 (CVSS 9.0) hits Windows-hosted servers running both routers without Cache Components; Linux and macOS aren’t affected.
• Vercel auto-protects deployed apps with no redeploy needed; Netlify and other hosts require an explicit upgrade to 16.3.3 or 15.5.24.