Next.js Patches Two RCE Bugs, Vercel and Netlify Ship Unaffected

Next.js disclosed two critical-severity vulnerabilities on Aug. 25, both capable of unauthenticated remote code execution, and shipped patches in 16.3.3 and 15.5.24 the same day (Next.js blog, Aug. 25, 2026). Vercel and Netlify each published a same-day advisory telling customers their hosted deployments were already out of reach of both bugs.

---

What changed

The first flaw, CVE-2026-75604 (GHSA-p293-qw3h-jr36), is a path-traversal bug in apps that mix the Pages Router and App Router without Cache Components. It only reaches remote code execution when the Next.js server runs on a Windows filesystem. Linux and macOS deployments aren’t affected (Next.js blog, Aug. 25, 2026).

The second, GHSA-2xp9-vwfh-vxw4, sits in libheif, a dependency of the sharp image library Next.js uses for Image Optimization. A crafted AVIF file handed to that pipeline could trigger unauthenticated RCE, so the patched releases disable AVIF optimization outright until an upstream libheif fix lands (Next.js blog, Aug. 25, 2026). Next.js had flagged one critical bug in an advance notice a day earlier; the count doubled to two by the time the release actually shipped (Next.js blog, Aug. 25, 2026).

Both platforms Firerun tracks that run Next.js in production said the same thing within hours: no customer action required. Vercel’s changelog said hosted applications “are protected”: no upgrades, config changes or redeploys needed, and it had already disabled AVIF optimization across its managed Image Optimization service once the bug was identified (Vercel changelog, Aug. 25, 2026). Netlify’s advisory was more specific about why its infrastructure sidesteps both bugs: Netlify Functions and Edge Functions run on Linux, so the Windows-only path-traversal flaw doesn’t apply, and Netlify’s runtime doesn’t execute the Next.js code path the AVIF bug depends on. Netlify still recommends customers upgrade regardless (Netlify changelog, Aug. 25, 2026).

Anyone self-hosting Next.js outside a managed platform doesn’t get either pass automatically. A Windows-hosted server mixing both routers without Cache Components, or any deployment still processing untrusted AVIF uploads through Image Optimization, is exposed until it upgrades to 16.3.3 or 15.5.24.

Our take

This is the clearest advertisement either platform could ask for, and neither had to say a word of marketing to make it. A framework maintainer discloses two unauthenticated RCE bugs, and the two biggest managed hosts for that framework both get to say, on the record, “our customers were never exposed.” One doesn’t run Windows under the hood; the other patched its shared infrastructure before most customers even read the advisory. That’s the pitch for paying someone else to run your Next.js server: the vendor’s incident response happens upstream of your pager going off.

There’s an asymmetry here that matters next time a framework-level CVE lands. The severity score attached to a vulnerability describes the framework, not your deployment. Whether it reaches you depends on which OS your server runs, which router combination your app uses, and whether your host’s infrastructure even executes the vulnerable code path. Those are details a CVSS number can’t capture, and details a managed platform can absorb before you ever have to think about them.

Key Takeaways

• Next.js shipped 16.3.3 and 15.5.24 on Aug. 25, patching two critical unauthenticated-RCE bugs: a Windows-only path-traversal flaw and an AVIF image-processing flaw in a sharp/libheif dependency.
• Vercel says hosted applications are already protected, with AVIF optimization disabled platform-wide once the bug was identified.
• Netlify says its Linux-based Functions and Edge Functions never touch the vulnerable path for either bug, though it still recommends upgrading.
• Self-hosted Next.js outside a managed platform is not automatically covered and should upgrade to the patched versions now.