Next.js Security Update: Two Critical Vulnerabilities Require Immediate Patching

| Editorial Team On 31 Aug, 2026

Next.js Patches Two Critical Flaws Enabling Unauthenticated Remote Code Execution

Vercel has released emergency security patches for Next.js addressing two critical vulnerabilities — a heap buffer overflow triggered by malicious AVIF images and a Windows-specific path traversal flaw — both capable of enabling unauthenticated remote code execution.

The patches arrive as web framework security faces intensifying scrutiny. Next.js powers millions of production applications worldwide and has now logged multiple critical disclosures within a two-year window. For developers and security teams running self-hosted Next.js deployments, the August 2026 update is not optional — it is urgent.

What the Vulnerabilities Do and Who Is at Risk

The Windows Path Traversal Flaw

The Windows path traversal flaw tracked as CVE-2026-75604 carries a CVSS score of 9.0. It affects Next.js applications using both the Pages Router and App Router without Cache Components when the server runs on a Windows filesystem. Linux and macOS deployments are not affected by this specific vulnerability.

Vercel was unambiguous in its advisory: "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." Researchers evolutionstorm and B0RI received credit for the responsible disclosure of this flaw.

Understanding the full scope of risk here matters. Organizations running self-hosted Windows deployments with no viable workaround face a narrow, urgent window to act before exploitation becomes a realistic threat. For teams that haven't previously conducted a formal structured vulnerability assessment of their application infrastructure, this incident underscores exactly why that process should be a standing practice rather than a reactive one.

The AVIF Image Optimization Flaw

The second vulnerability is an AVIF image optimization flaw rated CVSS v4: 9.5. Next.js uses the sharp image processing package to handle image optimization, and sharp relies on the libheif C library to parse AVIF files. A heap buffer overflow in libheif's image scaling code creates a pathway to remote code execution when Next.js processes an attacker-controlled AVIF image.

The exploit mechanism is precise and technically severe. A crafted AVIF file containing nested identity-derivation and auxiliary item references causes libheif to build a decoded image with two Alpha plane entries at different bit depths. The scaler allocates a destination buffer sized for the first 8-bit Alpha entry but then writes 16-bit sample values from the second entry into that same buffer — overwriting approximately 16,384 bytes past the allocation boundary.

Researchers rootxharsh and KarimPwnz of the Hacktron team released a full Python proof-of-concept reproducing the heap corruption under an address sanitizer build. "We were able to get RCE using this on multiple applications," the researchers stated in the libheif advisory. That claim had not been independently corroborated as of publication.

Critically, the AVIF vulnerability only affects deployments where developers have explicitly added image/avif to the formats configuration inside next.config.js. Applications without that configuration are not exposed to this specific flaw. The patched Next.js releases disable AVIF optimization entirely until the upstream fix propagates from libheif — which as of August 27, 2026, had not yet published version 1.23.2.

Editor's note: The decision to disable AVIF optimization entirely in the patched releases is a deliberate, conservative mitigation. Until libheif 1.23.2 is published and integrated, re-enabling AVIF support in any production deployment carries residual risk, regardless of the Next.js patch status.

Affected Versions and How to Patch Now

Version Ranges and Patch Availability

The fixes are available in Next.js 15.5.24 (Maintenance LTS) and Next.js 16.3.3 (Active LTS), published on August 25, 2026.

The AVIF vulnerability affects Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2.
The Windows path traversal affects versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2.

Developers can apply the patches by running:

npm install next@15.5.24 for the 15.5 line
npm install next@16.3.3 for the 16.3 line

Applications hosted directly on Vercel's platform are already protected from both vulnerabilities and require no upgrade action. Self-hosted deployments carry the full exposure.

Why the Release Moved Forward

Vercel had originally scheduled the August patches for August 26 as part of its formal monthly security cadence — the second release under a program the company announced in July 2026. The release moved forward by one day after the team identified an additional critical-severity vulnerability in an upstream dependency.

"Earlier today, we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies," Josh Story, Karim Rahal, and Sebastian Silbermann said in Vercel's security blog post.

Post-Patch Configuration Checklist

For teams applying the August patches, the following steps are recommended before returning to normal operations:

Confirm your running Next.js version matches 15.5.24 or 16.3.3 after installation.
Audit next.config.js for any image/avif entries in the formats array and remove or comment them out until libheif 1.23.2 is available and integrated.
For Windows-hosted deployments, verify the upgrade completed successfully and that no earlier version remains active in containerised or CI/CD pipeline environments.
Subscribe to Vercel's security advisories to receive future patch notifications as part of standing operational practice.

A Pattern of Critical Disclosures in Next.js

An Accelerating Vulnerability Timeline

The August patches are not an isolated event. Next.js has logged a series of high-severity vulnerabilities over the past two years that should concern any organisation running the framework in production.

In March 2025, a critical middleware bypass flaw allowed unauthenticated attackers to skip authorisation checks entirely in self-hosted deployments. In December 2025, the React2Shell deserialization vulnerability in React Server Components carried a CVSS score of 10.0 and was actively exploited within hours of public disclosure.

This pattern illustrates a broader reality that extends well beyond Next.js: the attack surface of modern web frameworks is expanding, and the consequences of delayed patching are increasingly severe. For organisations that haven't yet made application-level website security a formal priority, the documented trajectory of Next.js disclosures makes a compelling case for doing so now.

The Role of LLM-Assisted Vulnerability Discovery

Vercel's July 2026 program announcement offered context for the acceleration. "The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery," Andrew Imm and Josh Story wrote. AI tools are multiplying the pace of vulnerability discovery faster than many teams can absorb and respond — a dynamic that compresses the window between disclosure and exploitation in ways that traditional patch management cycles were not designed to handle.

The first scheduled monthly release published July 21 addressed nine vulnerabilities covering denial-of-service, server-side request forgery, and middleware bypass classes. Developers who applied those July patches still require the August upgrade. No exploitation of either August vulnerability had been reported as of August 27, 2026.

What This Means for Framework-Dependent Security Postures

The frequency of critical Next.js disclosures raises a structural question for security and engineering teams: how much of your application's security posture depends on the upstream framework vendor's patch cadence, and how quickly can your organisation respond when that cadence accelerates?

Understanding why cybersecurity matters at the application layer is no longer an abstract concern for framework-dependent deployments — it is an operational requirement. The combination of LLM-assisted discovery, proof-of-concept availability, and compressed exploitation timelines means that self-hosted deployments need both rapid patch deployment capability and continuous visibility into upstream dependency chains.

The Hacker News reached out to Vercel for comment and had not received a response by the time of publication.

How to Act on This Information

If you manage a self-hosted Next.js deployment on Windows, treat this as an emergency patch event and upgrade to 15.5.24 or 16.3.3 immediately — no workaround exists for CVE-2026-75604.
If your Next.js configuration includes image/avif in next.config.js, audit that setting now and apply the August patch before re-enabling AVIF optimization once libheif releases its upstream fix.
Security and engineering teams should review Vercel's monthly security cadence program and subscribe to its advisories as a standing practice given the documented acceleration of LLM-assisted vulnerability research targeting popular frameworks.