Next.js Ships Two Critical RCEs — Patch to 16.3.3 Now

Next.js released v16.3.3 and v15.5.24 a day early to patch two critical-severity unauthenticated RCEs — one in the libheif AVIF decoder used by sharp, one on Windows-hosted servers running both Pages and App Router. Here's the four-check action list.

Next.js Shipped Two Critical RCEs in 24 Hours — Here's What Production Teams Need to Do

On August 25, 2026, Vercel moved the Next.js security release forward by a full day. The reason: a second critical-severity vulnerability had surfaced overnight, and bundling both fixes into one release meant production teams would only need to upgrade once. The patched versions — v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) — landed hours later.

The headline: two unauthenticated remote code execution vulnerabilities, both rated critical, in adjacent parts of the framework. If you run Next.js in production, this is a patch-today advisory — not a patch-this-week one.

This post walks through what each CVE does, who's exposed, and the four checks to run before lunch.

CVE-1: AVIF + libheif supply-chain RCE

Identifiers: GHSA-2xp9-vwfh-vxw4 (Next.js) / GHSA-g89c-p67h-r497 (libheif)
Severity: Critical
Vector: Network, unauthenticated
Affected: Next.js versions using AVIF in the Image Optimization API

The vulnerability lives in libheif, the HEIF/AVIF decoding library bundled inside sharp — the image-processing engine Next.js uses for next/image optimization. When a Next.js server is asked to optimize an attacker-controlled AVIF image, the malformed input reaches libheif, which fails to handle it safely, and the server executes code under the Next.js process.

The fix in 16.3.3 and 15.5.24 disables AVIF optimization entirely in Next.js. That's not a workaround — it's the patch. AVIF will stay off until libheif ships its own upstream fix, which has no public timeline.

Who's exposed: any Next.js deployment where AVIF appears in the formats array of your next.config.js, or where AVIF is allowed as an Accept-header response. Default next/image behavior in many templates enables this.

Supply-chain attack path: malicious AVIF → Next.js → sharp → libheif → RCE

Key insight: this CVE wasn't found in code Vercel wrote. It was found in a transitive dependency three layers down. Your application inherits the security posture of every npm package your image pipeline touches.

CVE-2: Windows-only Pages + App Router RCE

Identifiers: CVE-2026-75604 / GHSA-p293-qw3h-jr36
Severity: Critical
Vector: Network, unauthenticated
Affected: Windows-hosted Next.js servers running both Pages Router AND App Router without Cache Components

The narrower blast radius here: Linux and macOS servers are not affected. Windows-hosted servers running both router types without Cache Components are.

The Next.js team's published guidance is unambiguous — "there is no known workaround for affected Windows-hosted applications." The only fix is to upgrade to 16.3.3 or 15.5.24.

Who's exposed: smaller subset than CVE-1, but every Windows-hosted team running Next.js should still check. The dual-router configuration is common in apps mid-migration from Pages Router to App Router — exactly the teams most likely to ship fast and skip the upgrade step.

The four checks to run right now

Before you close this tab:

Version check. Run npm ls next (or pnpm why next). If you're on 16.0.0 through 16.3.2, or 15.0.0 through 15.5.23, you are on a vulnerable line. Upgrade to 16.3.3 or 15.5.24.
OS check. Are you deploying to Windows? If yes and you're using both Pages Router and App Router, treat this as an out-of-band patch.
AVIF check. Open next.config.js and look for images.formats. If image/avif is in there, your server has been parsing AVIF and may have been exposed. Remove it (or rely on the patched default behavior).
Logging check. Scan the last 30 days of access logs for requests to /_next/image with Accept: image/avif headers or .avif URLs from external sources. Suspicious patterns warrant an incident review.

For most teams, step 1 alone closes both CVEs. The patch is a single npm install next@16.3.3 (or 15.5.24 for the maintenance line) followed by a redeploy.

Why Vercel bundled two CVEs into one release

The team's own note is worth quoting:

"We are addressing both vulnerabilities in the same release so users only need to upgrade once." (nextjs.org/blog/nextjs-security-release-august-2026-update)

This is a deliberate shift. Six months ago, the Next.js CVE cycle was: one CVE, one advisory, one patch window. Today, Vercel is consolidating because the supply-chain surface has grown faster than the release cadence. sharp is one of dozens of native dependencies Next.js relies on for "just works" behavior — and every native dep is a potential CVE vector.

Expect this pattern to continue. Security releases will become bundled, more frequent, and more impactful, because the framework's threat surface is now dominated by code outside its own repo.

What to watch next

Three things worth tracking over the next two weeks:

libheif upstream fix. Once it ships, Next.js can re-enable AVIF optimization. Until then, expect lower image compression efficiency on next/image responses.
Active exploitation reports. As of the August 25 advisory, Vercel has not used "active exploitation" language (compare to the July TeamCity CVE-2026-63077 advisory, which did). If that language gets added, expect emergency patching guidance.
CVE-2026-75604 patch adoption. Windows-hosted Next.js deployments are statistically smaller than Linux-hosted ones, which makes them easier to forget in upgrade waves. Watch your CDN or WAF for unusual traffic patterns to dual-router endpoints.

The takeaway

Two unauthenticated RCEs in 24 hours is unusual. Bundling them into a single early release is good operational hygiene from Vercel's side. The corresponding ask from your side: don't wait for the next scheduled upgrade window. This one is worth a same-day deploy.

For a deeper dive into the libheif advisory chain itself, the GitHub Security Advisory threads (GHSA-g89c-p67h-r497 and GHSA-2xp9-vwfh-vxw4) are worth bookmarking.

Patch today. Check your AVIF config. And if you're on Windows, don't skip this one.

Sources:

Next.js Shipped Two Critical RCEs in 24 Hours — Here's What Production Teams Need to Do

This post walks through what each CVE does, who's exposed, and the four checks to run before lunch.

CVE-1: AVIF + libheif supply-chain RCE

Supply-chain attack path: malicious AVIF → Next.js → sharp → libheif → RCE

CVE-2: Windows-only Pages + App Router RCE

The narrower blast radius here: Linux and macOS servers are not affected. Windows-hosted servers running both router types without Cache Components are.

The Next.js team's published guidance is unambiguous — "there is no known workaround for affected Windows-hosted applications." The only fix is to upgrade to 16.3.3 or 15.5.24.

The four checks to run right now

Before you close this tab:

Version check. Run npm ls next (or pnpm why next). If you're on 16.0.0 through 16.3.2, or 15.0.0 through 15.5.23, you are on a vulnerable line. Upgrade to 16.3.3 or 15.5.24.
OS check. Are you deploying to Windows? If yes and you're using both Pages Router and App Router, treat this as an out-of-band patch.
AVIF check. Open next.config.js and look for images.formats. If image/avif is in there, your server has been parsing AVIF and may have been exposed. Remove it (or rely on the patched default behavior).
Logging check. Scan the last 30 days of access logs for requests to /_next/image with Accept: image/avif headers or .avif URLs from external sources. Suspicious patterns warrant an incident review.

For most teams, step 1 alone closes both CVEs. The patch is a single npm install next@16.3.3 (or 15.5.24 for the maintenance line) followed by a redeploy.

Why Vercel bundled two CVEs into one release

The team's own note is worth quoting:

"We are addressing both vulnerabilities in the same release so users only need to upgrade once." (nextjs.org/blog/nextjs-security-release-august-2026-update)

Expect this pattern to continue. Security releases will become bundled, more frequent, and more impactful, because the framework's threat surface is now dominated by code outside its own repo.

What to watch next

Three things worth tracking over the next two weeks:

libheif upstream fix. Once it ships, Next.js can re-enable AVIF optimization. Until then, expect lower image compression efficiency on next/image responses.
Active exploitation reports. As of the August 25 advisory, Vercel has not used "active exploitation" language (compare to the July TeamCity CVE-2026-63077 advisory, which did). If that language gets added, expect emergency patching guidance.
CVE-2026-75604 patch adoption. Windows-hosted Next.js deployments are statistically smaller than Linux-hosted ones, which makes them easier to forget in upgrade waves. Watch your CDN or WAF for unusual traffic patterns to dual-router endpoints.

The takeaway

For a deeper dive into the libheif advisory chain itself, the GitHub Security Advisory threads (GHSA-g89c-p67h-r497 and GHSA-2xp9-vwfh-vxw4) are worth bookmarking.

Patch today. Check your AVIF config. And if you're on Windows, don't skip this one.

Sources: