--- title: Next.js August 2026 Security Release: Two Critical RCE... description: Next.js released v16.3.3 and v15.5.24 a day early to patch two unrelated unauthenticated RCE vulnerabilities. One affects AVIF image handling via an upstream... canonical: https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Next.js August 2026 Security Release: Two Critical RCE Vulnerabilities Patched | daily.dev og:description: Next.js released v16.3.3 and v15.5.24 a day early to patch two unrelated unauthenticated RCE vulnerabilities. One affects AVIF image handling via an upstream... og:url: https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt og:image: https://api.daily.dev/og/posts/iSXQGLfRT.png og:image:alt: Next.js August 2026 Security Release: Two Critical RCE Vulnerabilities Patched og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Next.js August 2026 Security Release: Two Critical RCE Vulnerabilities Patched **[Collections](https://daily.dev/sources/collections)** · 2 min read · 3 upvotes · 0 comments ## Summary Next.js released v16.3.3 and v15.5.24 a day early to patch two unrelated unauthenticated RCE vulnerabilities. One affects AVIF image handling via an upstream libheif bug in sharp, fixed by disabling AVIF optimization until libheif is patched. The other, CVE-2026-75604, hits Windows-hosted servers running Pages Router or App Router without Cache Components, with no workaround other than upgrading; Linux and macOS are unaffected. Vercel users are already protected since AVIF optimization was disabled platform-wide and Vercel's Linux runtime isn't exposed to the Windows-specific bug. ## Content Next.js released versions 16.3.3 and 15.5.24 on August 25, 2026, one day ahead of the originally planned security release date. The earlier timeline was triggered by a second critical vulnerability discovered after the initial announcement, so both fixes ship together. ## The two vulnerabilities **AVIF image processing RCE (GHSA-2xp9-vwfh-vxw4)** The Image Optimization API has an unauthenticated remote code execution flaw when processing AVIF images. The root cause is in libheif, an upstream dependency used by sharp. Because there's no upstream fix yet, the patch works around it by disabling AVIF optimization entirely. Self-hosted apps will serve AVIF requests unoptimized until a fixed libheif version ships. **Windows server RCE (CVE-2026-75604 / GHSA-p293-qw3h-jr36)** The second vulnerability affects Next.js servers running on Windows that use Pages Router or App Router without Cache Components. It also allows unauthenticated remote code execution. There is no known workaround for this one — upgrading is the only fix. Linux and macOS are not affected. ## Who needs to act If you self-host Next.js, upgrade now: ``` npm install next@15.5.24 # for 15.x or earlier npm install next@16.3.3 # for 16.x ``` Applications hosted on Vercel are already protected. Vercel disabled AVIF optimization across its managed Image Optimization service, and its runtime runs Linux, so neither vulnerability applies. The Windows RCE has no workaround, so self-hosted Windows deployments should treat this as urgent. ## Questions this post answers ### What versions of Next.js fix the unauthenticated RCE vulnerabilities from the August 2026 security release? Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released August 25 instead of the originally planned date because a second critical bug surfaced late. The release bundles fixes for two unrelated unauthenticated remote code execution issues: an AVIF image handling flaw and a Windows-specific bug tracked as CVE-2026-75604. _Track Next.js security patches like this one on daily.dev before an unpatched RCE reaches production._ ### Why are my Next.js AVIF images no longer optimized after upgrading to fix the security vulnerability? AVIF optimization was intentionally disabled to patch an unauthenticated RCE in the Image Optimization API, caused by an upstream bug in libheif pulled in through sharp. Since Next.js cannot patch libheif directly, images will serve unoptimized in AVIF format until a corrected libheif version ships upstream; this is expected behavior, not a regression. _Developers debugging unexpected image behavior after a security patch can follow the fix details on daily.dev._ ### Does the Next.js CVE-2026-75604 Windows RCE vulnerability affect Vercel-hosted or Linux/macOS deployments? No, CVE-2026-75604 only affects self-hosted Next.js servers running on Windows using Pages Router or App Router without Cache Components; there is no workaround besides upgrading. Linux and macOS deployments are unaffected, and Vercel is safe by default since its runtime is Linux-based. _Teams deciding where and how to host Next.js can weigh platform-specific risks like this on daily.dev._ ## Similar posts on daily.dev - [Upcoming Next.js August Security Release](https://daily.dev/posts/upcoming-next-js-august-security-release-grrtb58k9) · Next.js · 7 upvotes · 0 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 130 upvotes · 4 comments --- Tags: [#security](https://daily.dev/tags/security), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Next.js August 2026 Security Release: Two Critical RCE Vulnerabilities Patched","url":"https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt"},"datePublished":"2026-08-25T19:03:51.766Z","dateModified":"2026-08-27T14:30:53.511Z","description":"Next.js released v16.3.3 and v15.5.24 a day early to patch two unrelated unauthenticated RCE vulnerabilities. One affects AVIF image handling via an upstream...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82cd06407cf2123eeabb5a499fed2339?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82cd06407cf2123eeabb5a499fed2339?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nextjs,vercel","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Next.js August 2026 Security Release: Two Critical RCE Vulnerabilities Patched"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/next-js-august-2026-security-release-two-critical-rce-vulnerabilities-patched-isxqglfrt#faq","mainEntity":[{"@type":"Question","name":"What versions of Next.js fix the unauthenticated RCE vulnerabilities from the August 2026 security release?","acceptedAnswer":{"@type":"Answer","text":"Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released August 25 instead of the originally planned date because a second critical bug surfaced late. The release bundles fixes for two unrelated unauthenticated remote code execution issues: an AVIF image handling flaw and a Windows-specific bug tracked as CVE-2026-75604. Track Next.js security patches like this one on daily.dev before an unpatched RCE reaches production."}},{"@type":"Question","name":"Why are my Next.js AVIF images no longer optimized after upgrading to fix the security vulnerability?","acceptedAnswer":{"@type":"Answer","text":"AVIF optimization was intentionally disabled to patch an unauthenticated RCE in the Image Optimization API, caused by an upstream bug in libheif pulled in through sharp. Since Next.js cannot patch libheif directly, images will serve unoptimized in AVIF format until a corrected libheif version ships upstream; this is expected behavior, not a regression. Developers debugging unexpected image behavior after a security patch can follow the fix details on daily.dev."}},{"@type":"Question","name":"Does the Next.js CVE-2026-75604 Windows RCE vulnerability affect Vercel-hosted or Linux/macOS deployments?","acceptedAnswer":{"@type":"Answer","text":"No, CVE-2026-75604 only affects self-hosted Next.js servers running on Windows using Pages Router or App Router without Cache Components; there is no workaround besides upgrading. Linux and macOS deployments are unaffected, and Vercel is safe by default since its runtime is Linux-based. Teams deciding where and how to host Next.js can weigh platform-specific risks like this on daily.dev."}}]} ```