Next.js Shipped Two Critical RCEs in 24 Hours — Here's What Production Teams Need to Do
Published on 2026-08-26
Next.js released v16.3.3 and v15.5.24 a day early to patch two critical-severity unauthenticated RCEs — one in the libheif AVIF decoder used by sharp, one on Windows-hosted servers running both Pages and App Router. Here's the four-check action list.
Next.js Shipped Two Critical RCEs in 24 Hours — Here's What Production Teams Need to Do
On August 25, 2026, Vercel moved the Next.js security release forward by a full day. The reason: a second critical-severity vulnerability had surfaced overnight, and bundling both fixes into one release meant production teams would only need to upgrade once. The patched versions — v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) — landed hours later.
The headline: two unauthenticated remote code execution vulnerabilities, both rated critical, in adjacent parts of the framework. If you run Next.js in production, this is a patch-today advisory — not a patch-this-week one.
This post walks through what each CVE does, who's exposed, and the four checks to run before lunch.
CVE-1: AVIF + libheif supply-chain RCE
Identifiers: GHSA-2xp9-vwfh-vxw4 (Next.js) / GHSA-g89c-p67h-r497 (libheif)
Severity: Critical
Vector: Network, unauthenticated
Affected: Next.js versions using AVIF in the Image Optimization API
The vulnerability lives in libheif, the HEIF/AVIF decoding library bundled inside sharp — the image-processing engine Next.js uses for next/image optimization. When a Next.js server is asked to optimize an attacker-controlled AVIF image, the malformed input reaches libheif, which fails to handle it safely, and the server executes code under the Next.js process.
The fix in 16.3.3 and 15.5.24 disables AVIF optimization entirely in Next.js. That's not a workaround — it's the patch. AVIF will stay off until libheif ships its own upstream fix, which has no public timeline.
