Next.js patches two critical RCE holes, and where you host decides how exposed you were
Next.js shipped 16.3.3 and 15.5.24 to close two unauthenticated remote code execution vulnerabilities, one in AVIF image optimization and one on Windows self-hosted servers. Managed hosts absorbed most of the risk. Self-hosters, especially on Windows, carry it directly.
Next.js released patched builds on August 25 to close two critical, unauthenticated remote code execution vulnerabilities. Both are fixed in v16.3.3 on the Active LTS line and v15.5.24 on Maintenance LTS. The team had pre-announced a security release the week before, then moved the date forward after finding an additional critical flaw in an upstream dependency. Unauthenticated RCE is the most serious class of web vulnerability, because it lets an attacker run code on your server with no login and no user interaction. If you self-host Next.js, this is a patch-now event.
The two holes
The first is an unauthenticated RCE in the Image Optimization API, triggered when
Next.js optimizes an attacker-controlled AVIF image (GHSA-2xp9-vwfh-vxw4). The root
cause sits below Next.js, in the libheif library that the sharp image processor
depends on. It affects a wide version range: 10.0.0 up to 15.5.24, and 16.0.0 up to
16.3.3. Any app that exposes /_next/image and allows AVIF is in scope.
The second is an unauthenticated RCE on Windows-hosted servers (CVE-2026-75604). It hits applications that use both the Pages Router and the App Router without Cache Components, when the Next.js server runs on a Windows filesystem. Linux and macOS are not affected. The advisory is blunt about mitigation: there is no known workaround for affected Windows deployments, so patching is the only path.
The AVIF fix is really a dependency story
How Next.js patched the image bug is the detail worth reading. The framework cannot
fix libheif itself, so the patched releases disable AVIF optimization entirely until
an upstream fix propagates through sharp. That is a pragmatic call, but it has a
quiet consequence for working teams: if your pipeline relied on Next.js serving AVIF,
that format stops being optimized after you upgrade, and images fall back to other
formats. The security fix and a behavior change arrive in the same version bump.
This is the recurring shape of framework security in 2026. A meta-framework inherits the vulnerability surface of everything beneath it, and image processing, with its native codecs parsing untrusted bytes, is a perennial soft spot. The exposure did not originate in Next.js code, but the responsibility for shipping a safe default landed on the framework anyway.
Where you host decided your exposure
The clearest signal in this release is how differently the risk landed depending on
deployment. On Vercel, managed deployments were protected. Netlify, an independent host
and a useful outside read here, stated that its sites do not run the affected code
path at all: requests to /_next/image are rewritten to the Netlify Image CDN, and the
Windows RCE never applied because Netlify does not run Windows servers. Netlify still
recommended upgrading to a patched release and redeploying, which is the right posture,
but its customers were not in the blast radius.
Self-hosters were. A team running Next.js on its own infrastructure, particularly on Windows, carried the full weight of both vulnerabilities with a Windows workaround of exactly zero. The convenience of a managed platform and its security absorption are the same feature viewed from two angles, and a security release is when that trade becomes concrete rather than theoretical.
What to do
Upgrade to 16.3.3 or 15.5.24, then redeploy. Do it even on a managed host, because matching the patched version is cheaper than tracking which code paths your platform happens to shield. If you self-host on Windows and use both routers without Cache Components, treat this as urgent: there is no mitigation short of the patch. And if you depend on AVIF output, verify what your images look like after upgrading, since optimization for that format is off until the upstream fix lands.
The broader lesson is a boring one that keeps proving true. Your security exposure is not set only by the framework you choose, but by the layer you run it on and the dependencies you never see. This release made that visible in a single afternoon.
- August 2026 Security Release (Next.js blog) nextjs.org
- Netlify's statement on the critical Next.js vulnerabilities (Netlify changelog) www.netlify.com
- GHSA-2xp9-vwfh-vxw4: RCE in Image Optimization via AVIF (GitHub advisory) github.com
- GHSA-p293-qw3h-jr36: RCE on Windows-hosted servers, CVE-2026-75604 (GitHub advisory) github.com