By On August 25, the Next.js team shipped versions 16.3.3 and 15.5.24 to fix two critical vulnerabilities — both enabling unauthenticated remote code execution. If your app runs on a Windows server and you haven’t patched, there is no workaround. The fix is the patch, and it dropped two days ago. At 45 million weekly npm downloads, this deserves more than a changelog skim.
CVE-2026-75604: Windows Path Traversal, CVSS 9.0, No Workaround
The more immediately dangerous of the two is CVE-2026-75604, a path traversal flaw (CWE-22) with a CVSS score of 9.0. An unauthenticated attacker can exploit it to achieve remote code execution on any Next.js server running on Windows. The affected surface is wide: both the Pages Router and App Router (when used without Cache Components) are vulnerable.
The platform restriction matters. Linux and macOS deployments are not affected by this specific CVE. But Windows hosting for Next.js is not as rare as you might think — enterprise internal tools and smaller managed hosting setups run IIS or Windows-backed Node. If you’re in that category, the window for a leisurely upgrade has closed.
There is no configuration toggle, middleware flag, or environment variable that mitigates this. The official Next.js advisory is explicit: no workaround exists for Windows-hosted applications. Run the upgrade.
GHSA-2xp9-vwfh-vxw4: AVIF Images as an Attack Vector
The second vulnerability is platform-agnostic and covers a much wider version range. GHSA-2xp9-vwfh-vxw4 targets the Next.js Image Optimization API: a crafted AVIF file submitted to your image endpoint triggers a flaw in the underlying libheif library (via Sharp), resulting in unauthenticated RCE. The affected version range stretches back to Next.js 10.0.0.
The patch disables AVIF optimization entirely until an upstream libheif fix is available. If you cannot upgrade immediately, remove AVIF from your image formats config as an interim measure:
// next.config.js — interim workaround only
module.exports = {
images: {
formats: ['image/webp'], // 'image/avif' removed
},
};Who Needs to Act (and Who Doesn’t)
Your exposure depends almost entirely on how your app is hosted:
- Vercel-hosted: Protected at the platform level. No upgrade, redeploy, or config change needed. Vercel confirmed immediate protection.
- Cloudflare-fronted: Emergency WAF rules covering both CVEs deployed August 26.
- Fastly customers: Virtual patch for CVE-2026-75604 deployed August 26.
- Self-hosted on Linux/macOS: Immune to the Windows CVE, but still need the AVIF fix — upgrade anyway.
- Self-hosted on Windows: Highest urgency. No partial mitigations exist. Upgrade immediately.
The Fix Takes 30 Seconds
# Check your current version
npm list next
# If on 15.x (Maintenance LTS)
npm install next@15.5.24
# If on 16.x (Active LTS)
npm install next@16.3.3No configuration changes are required beyond the version bump. AVIF optimization is simply disabled in patched versions until the libheif upstream fix ships in a future release.
The Bigger Problem With Next.js Security in 2026
This is the third major critical security event for Next.js this year. January brought a DoS vulnerability. May dropped 13 CVEs in a single release — the framework’s largest patch batch ever. August now adds two RCE vectors. Three critical events in eight months is a pattern, not a coincidence.
The framework’s complexity is part of the answer. Next.js combines SSR, React Server Components, edge middleware, image optimization, and multi-pattern routing into one package — a genuinely large attack surface. The AVIF vector is worth watching beyond Next.js: any framework that aggressively adopted the image format and routes through libheif or Sharp carries similar exposure. This vulnerability class is not going away.
The practical conclusion: if your team is still on a version older than 15.x, there is no reasonable justification left. The Maintenance LTS (15.5.24) and Active LTS (16.3.3) tracks exist for exactly these moments. Netlify’s breakdown of the operational impact is worth a read for teams weighing upgrade timing. Zero known exploits in the wild right now is a window — not a reason to wait.
