Two critical Next.js vulnerabilities were disclosed in the August 2026 Security Release: an unauthenticated RCE via the upstream libheif dependency during AVIF image processing (GHSA-2xp9-vwfh-vxw4), and an unauthenticated RCE affecting Windows-hosted Next.js servers using Pages Router or App Router without Cache Components (CVE-2026-75604 / GHSA-p293-qw3h-jr36). Vercel-hosted applications are already protected: AVIF optimization was disabled across Vercel's managed Image Optimization service, and Vercel's runtime uses Linux, so it is unaffected by the Windows vulnerability. Self-hosted Next.js applications must upgrade to next@15.5.24 (for 15.x or earlier) or next@16.3.3 (for 16.x); there is no workaround for the Windows issue, and self-hosted AVIF handling will serve images unoptimized until a fixed libheif version ships.
Table of contents
SummaryImpact on Vercel deploymentsResolution for self-hosted applicationsCreditReferencesQuestions this post answers
How do I fix the Next.js AVIF image optimization remote code execution vulnerability?
Upgrade to next@15.5.24 if running Next.js 15.x or earlier, or next@16.3.3 if running Next.js 16.x. The vulnerability, tracked as GHSA-2xp9-vwfh-vxw4, originates in the upstream libheif dependency and allows unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. In the patched releases, AVIF images are served as-is without resizing or optimization until a fixed libheif version ships. daily.dev surfaces security releases like this so self-hosted Next.js teams patch before attackers do.
Is my Next.js app on Vercel vulnerable to the August 2026 Windows RCE bug CVE-2026-75604?
No, applications hosted on Vercel are not affected because Vercel's Next.js runtime uses Linux, and this vulnerability only impacts servers running on a Windows filesystem using the Pages Router or App Router without Cache Components. Self-hosted applications on Windows have no workaround and must upgrade immediately to next@15.5.24 or next@16.3.3. Teams weighing self-hosting versus managed Next.js hosting can track incidents like this on daily.dev.
Do I need to redeploy my Vercel app after the Next.js August 2026 security advisories?
No, no upgrades, configuration changes, or redeploys are required for applications hosted on Vercel. Vercel disabled AVIF optimization across its managed Image Optimization service once the vulnerability was identified, so AVIF inputs are now served as-is and bypass the affected processing path entirely, while the separate Windows-only vulnerability does not apply to Vercel's Linux-based runtime. daily.dev helps developers separate platform-side fixes from action items during security releases like this one.