By Next.js shipped two critical remote code execution vulnerabilities on August 25, 2026, both unauthenticated, both addressed in the same release. One lives inside the AVIF image decoding stack — not in Next.js’s own code, but two dependency layers deep in a C library. The other lets an attacker write files anywhere on a Windows server by crafting a URL. If you self-host Next.js and haven’t moved to 16.3.3 or 15.5.24, your server is exposed right now.
The AVIF Bug: When Your Image Optimizer Is the Attack Surface
The first vulnerability (GHSA-2xp9-vwfh-vxw4) is a heap buffer overflow in libheif, the C library that sharp uses to decode AVIF images. Next.js uses sharp for image optimization. If an attacker can point your image optimizer at a crafted AVIF file — through a user upload, an <Image> src you don’t fully control, or an external URL — they can trigger unauthenticated RCE on your server.
The uncomfortable part: libheif doesn’t appear anywhere in your package.json. You depend on Next.js. Next.js depends on sharp. Sharp depends on libheif. Three hops, and an attacker is executing code on your server. This is the transitive dependency risk that software supply chain security guidance keeps warning about — now with a concrete, production-scale example.
The patch takes the direct route: patched releases disable AVIF optimization entirely until libheif ships a fix upstream. After upgrading, AVIF images are served without optimization — original file size, no processing. If your site depends on AVIF for Core Web Vitals performance, expect a bandwidth regression. Set image/webp as your primary format in the interim.
The Windows Path Traversal: File Writes Without Authentication
The second vulnerability (CVE-2026-75604, CVSS 9.0) is more conditional but mechanically blunt. Windows treats backslash as a directory separator; POSIX systems do not. Next.js’s routing layer didn’t fully normalize percent-encoded backslash sequences when an application used both Pages Router and App Router without Cache Components on a Windows filesystem. An attacker crafts a URL, the path traversal resolves outside the cache directory, and arbitrary files get written — leading to RCE.
No authentication. No user interaction. Scope rated as “changed,” meaning the blast radius extends beyond the vulnerable component. Linux and macOS deployments are not affected. But Windows hosting for Node.js is more common than the developer community tends to assume: Azure App Service on Windows, enterprise IIS-fronted deployments, Windows containers in legacy enterprise environments. There is no known workaround. The only fix is to upgrade.
Who Is Affected and What to Do
| Deployment | AVIF Vuln | Windows Path Traversal |
|---|---|---|
| Vercel (managed) | Protected automatically | Protected automatically |
| Cloudflare WAF | Emergency rules (Aug 26) | Emergency rules (Aug 26) |
| Self-hosted Linux/macOS | Patch required | Not affected |
| Self-hosted Windows | Patch required | Patch required — no workaround |
| Docker (Linux container) | Patch required | Not affected |
Run the appropriate command for your branch:
# Active LTS (Next.js 16)
npm install next@16.3.3
# Maintenance LTS (Next.js 15)
npm install next@15.5.24
# Verify the running version
npx next --versionUpdating package.json alone is not sufficient. Rebuild your deployment artifact — Docker image, build output, whatever your pipeline produces — and restart every running instance. Confirm the version inside the running container, not just the lock file. Cloudflare deployed emergency WAF rules on August 26 for both vulnerabilities. That buys time, not a pass on upgrading.
The Larger Problem With Next.js Security
This is the fourth significant security incident to hit Next.js in eighteen months. December 2025 brought a CVSS 10.0 React Server Components deserialization RCE. May 2025 brought a middleware authorization bypass actively exploited in the wild. March 2025 had the middleware bypass that dominated security feeds for a week. Now two more critical RCEs in a single release.
None of this means Next.js is uniquely reckless. Large, complex frameworks spanning two routing paradigms, image optimization pipelines, and Server Components accumulate attack surface. That’s the trade-off. But it does mean something actionable: if you run Next.js in production, you need a documented process for patching critical framework updates within 24 hours of disclosure. Not 72. Not “next sprint.” Twenty-four hours.
Read the official Next.js August 2026 security release notes for full technical details. Vercel-hosted? You’re already covered. Self-hosted? Upgrade now, verify in your running environment, and add Next.js to your automated dependency scanner’s critical-alert list.
