If you're self-hosting Next.js, this is worth five minutes of your day: the August 25, 2026 security release patched two Critical, unauthenticated remote code execution vulnerabilities. Both are already fixed — the question is just whether you've upgraded. One affects any app using AVIF image optimization; the other affects Windows-hosted servers specifically. Here's what each one is, and what to do about it.
**AVIF image optimization RCE**
GHSA-2xp9-vwfh-vxw4 is an unauthenticated RCE in the Image Optimization API when AVIF files are used — CVSS v4 9.5. The affected range is unusually wide: `next` 10.0.0 up to, but not including, 15.5.24, and versions before 16.3.3. Worth noting: this advisory has no CVE assigned, so don't confuse it with the CVE below.
Next.js's own release post attributes the root cause to the libheif library, reached through the sharp image-processing dependency — that's the vendor's account, not something independently confirmed here.
As an interim mitigation, 16.3.3 disabled AVIF optimization outright. 16.3.4 re-enabled it. The security fix itself doesn't require disabling AVIF specifically: 16.3.3 alone closes the vulnerability. But if your app depends on AVIF output, you'll want 16.3.4 or later, not 16.3.3.
**Windows-hosted path traversal RCE**
GHSA-p293-qw3h-jr36, tracked as CVE-2026-75604, is an unauthenticated RCE via path traversal — but only on Windows-hosted servers running Pages or App Router without Cache Components. CVSS v4 9.0. It affects next 13.4 through 15.5.24, and 16.0 through 16.3.3. There's no workaround listed; upgrading is the only fix.
**Exploitation status**
A public proof-of-concept exists for the Windows vulnerability. No confirmed real-world exploitation has been reported so far. Those are two different things — a public PoC raises the urgency, but it isn't evidence of attacks happening now.
**What to do**
Check your installed `next` version today:
- On the 15.x line: upgrade to **15.5.24** or later.
- On the 16.x line: upgrade to **16.3.3** or later — that's the minimum fix for both vulnerabilities.
- On 16.x and you use AVIF image optimization: go straight to **16.3.4** or later, since 16.3.3 disables it.
Both bugs are unauthenticated and Critical. If your Next.js server is internet-facing, treat this as a same-week upgrade, not a backlog item.
Sources:
- `https://nextjs.org/blog/august-2026-security-release`
- `https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4`
- `https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36`
- `https://github.com/vercel/next.js/releases/tag/v16.3.4`
- `https://github.com/vercel/next.js/releases/tag/v16.3.5`
- `https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497`
- `https://github.com/FORTBRIDGE-UK/cve-2026-75604`
- `https://labs.cloudsecurityalliance.org/research/csa-research-note-nextjs-avif-windows-rce-cve-2026-75604-202/`
Sources:
- https://nextjs.org/blog/august-2026-security-release
- https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
- https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
- https://github.com/vercel/next.js/releases/tag/v16.3.4
- https://github.com/vercel/next.js/releases/tag/v16.3.5
- https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
- https://github.com/FORTBRIDGE-UK/cve-2026-75604
- https://labs.cloudsecurityalliance.org/research/csa-research-note-nextjs-avif-windows-rce-cve-2026-75604-202/
