--- title: August 2026 Security Release | daily.dev description: Next.js released v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to patch two critical unauthenticated remote code execution vulnerabilities. One flaw is... canonical: https://daily.dev/posts/august-2026-security-release-w2p4igm5c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: August 2026 Security Release | daily.dev og:description: Next.js released v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to patch two critical unauthenticated remote code execution vulnerabilities. One flaw is... og:url: https://daily.dev/posts/august-2026-security-release-w2p4igm5c og:image: https://api.daily.dev/og/posts/W2p4IgM5c.png og:image:alt: August 2026 Security Release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # August 2026 Security Release **[Next.js](https://daily.dev/sources/next)** 路 2 min read 路 2 upvotes 路 2 comments ## Summary Next.js released v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to patch two critical unauthenticated remote code execution vulnerabilities. One flaw is in the Image Optimization API when handling AVIF images due to an underlying libheif issue used by sharp, patched by disabling AVIF optimization until an upstream fix arrives. The second affects Windows-hosted servers running both Pages Router and App Router without Cache Components, with no known workaround for those setups. Linux and macOS are unaffected by the second issue. Developers are urged to update immediately via npm install next@15.5.24 or next@16.3.3. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Next.js versions fix the critical RCE vulnerability in the Image Optimization API? Next.js versions 15.5.24 and 16.3.3 fix a critical unauthenticated remote code execution vulnerability in the Image Optimization API triggered by AVIF image processing. The flaw originates in the libheif library used by sharp. The patched releases disable AVIF optimization entirely until an upstream fix is available, tracked as GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497. _Teams patching production Next.js apps can track fast-moving security advisories like this on daily.dev._ ### Is there a workaround for the Next.js Windows RCE vulnerability CVE-2026-75604? No workaround exists. Applications using both the Pages Router and App Router without Cache Components are vulnerable to unauthenticated remote code execution when hosted on a Windows filesystem, tracked as CVE-2026-75604 / GHSA-p293-qw3h-jr36. Linux and macOS deployments are unaffected. The only fix is upgrading to Next.js 15.5.24 or 16.3.3. _Developers weighing hosting platform risk for Next.js can follow advisories like this on daily.dev._ ### How do I update Next.js to patch the August 2026 critical RCE vulnerabilities? Run npm install next@15.5.24 if on the 15.5 maintenance line, or npm install next@16.3.3 if on the 16.3 active LTS line. Vercel moved the release forward from its originally announced date after finding an additional critical severity vulnerability in an upstream dependency during the disclosure window. _Anyone maintaining Next.js in production can keep up with urgent patch releases like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@petecapecod** 路 0 upvotes > And, yet AGAIN it's time for another Next upgrade. Man I gotta just put these on an agent weekly upgrade schedule 馃憣馃徎 **@agustinbarrientos** 路 0 upvotes > Security releases should bypass the weekly upgrade cadence. First inventory Windows hosts, mixed Pages/App Router deployments, and AVIF optimization to find exposed services. After upgrading, test both affected paths instead of treating the version bump as proof. ## Similar posts on daily.dev - [September 2026 Security Release](https://daily.dev/posts/september-2026-security-release-z46gampdn) 路 Next.js 路 2 upvotes 路 0 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) 路 Vercel 路 131 upvotes 路 3 comments - [Next.js Security Update for Upstream Vulnerabilities](https://daily.dev/posts/next-js-security-update-for-upstream-vulnerabilities-pgjwbgncx) 路 Next.js 路 2 upvotes 路 0 comments - [Next.js Security Update for a Critical Upstream Issue](https://daily.dev/posts/next-js-security-update-for-a-critical-upstream-issue-j76akxv6g) 路 Next.js 路 0 upvotes 路 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/august-2026-security-release-w2p4igm5c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"August 2026 Security Release","url":"https://daily.dev/posts/august-2026-security-release-w2p4igm5c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/august-2026-security-release-w2p4igm5c"},"datePublished":"2026-08-25T16:51:58.556Z","dateModified":"2026-09-13T21:48:09.264Z","description":"Next.js released v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to patch two critical unauthenticated remote code execution vulnerabilities. One flaw is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d8341b9d8da3231afd5caa80af93821?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d8341b9d8da3231afd5caa80af93821?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Next.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Next.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a7460ee33d92486cb5afd0fca36a116d","url":"https://daily.dev/sources/next"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/august-2026-security-release-w2p4igm5c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,nextjs,vercel","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Next.js","item":"https://daily.dev/sources/next"},{"@type":"ListItem","position":3,"name":"August 2026 Security Release"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/august-2026-security-release-w2p4igm5c","comment":[{"@type":"Comment","text":"And, yet AGAIN it鈥檚 time for another Next upgrade. Man I gotta just put these on an agent weekly upgrade schedule 馃憣馃徎","datePublished":"2026-08-26T12:30:27.304Z","url":"https://daily.dev/posts/W2p4IgM5c#c-kXIIEICR1","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}},{"@type":"Comment","text":"Security releases should bypass the weekly upgrade cadence. First inventory Windows hosts, mixed Pages/App Router deployments, and AVIF optimization to find exposed services. After upgrading, test both affected paths instead of treating the version bump as proof.","datePublished":"2026-08-26T23:07:27.149Z","url":"https://daily.dev/posts/W2p4IgM5c#c-yW1QhJbgU","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/august-2026-security-release-w2p4igm5c#faq","mainEntity":[{"@type":"Question","name":"What Next.js versions fix the critical RCE vulnerability in the Image Optimization API?","acceptedAnswer":{"@type":"Answer","text":"Next.js versions 15.5.24 and 16.3.3 fix a critical unauthenticated remote code execution vulnerability in the Image Optimization API triggered by AVIF image processing. The flaw originates in the libheif library used by sharp. The patched releases disable AVIF optimization entirely until an upstream fix is available, tracked as GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497. Teams patching production Next.js apps can track fast-moving security advisories like this on daily.dev."}},{"@type":"Question","name":"Is there a workaround for the Next.js Windows RCE vulnerability CVE-2026-75604?","acceptedAnswer":{"@type":"Answer","text":"No workaround exists. Applications using both the Pages Router and App Router without Cache Components are vulnerable to unauthenticated remote code execution when hosted on a Windows filesystem, tracked as CVE-2026-75604 / GHSA-p293-qw3h-jr36. Linux and macOS deployments are unaffected. The only fix is upgrading to Next.js 15.5.24 or 16.3.3. Developers weighing hosting platform risk for Next.js can follow advisories like this on daily.dev."}},{"@type":"Question","name":"How do I update Next.js to patch the August 2026 critical RCE vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Run npm install next@15.5.24 if on the 15.5 maintenance line, or npm install next@16.3.3 if on the 16.3 active LTS line. Vercel moved the release forward from its originally announced date after finding an additional critical severity vulnerability in an upstream dependency during the disclosure window. Anyone maintaining Next.js in production can keep up with urgent patch releases like this via daily.dev."}}]} ```