Vercel shipped patches for two critical Next.js vulnerabilities on August 25, 2026, both allowing unauthenticated remote code execution on an unpatched server. If your site runs on Next.js, whether you built it yourself or a developer set it up for you, this is one of the rare security releases worth stopping to check immediately rather than filing away for the next routine maintenance window.
What Actually Broke
The first flaw (GHSA-2xp9-vwfh-vxw4) lives in libheif, a dependency Next.js’s built-in Image Optimization feature uses to process AVIF image files, and scores 9.5 out of 10 in severity. A specially crafted AVIF file, the kind that could arrive through a normal image upload feature, can trigger remote code execution without any authentication. Vercel’s fix disables AVIF optimization entirely until the upstream libheif issue is resolved, which tells you how seriously they’re treating it: it’s not tuned down, it’s turned off.
The second flaw (CVE-2026-75604, GHSA-p293-qw3h-jr36) scores 9.0 and is a path traversal bug that leads to unauthenticated remote code execution specifically on Next.js servers hosted on Windows, affecting both the Pages Router and the App Router when Cache Components aren’t in use. Two separate, unrelated vulnerability classes landing in the same release, both rated critical, both requiring no authentication to exploit, is what makes this release worth treating as urgent rather than routine.
Who’s Actually Exposed
The Windows path traversal flaw only affects Next.js servers actually running on Windows, which narrows its blast radius somewhat since most production Next.js deployments run on Linux. The AVIF flaw is broader: any Next.js site using the built-in Image Optimization feature with AVIF support enabled is potentially exposed, regardless of underlying OS, since the vulnerable code path is in image processing, not the server platform. As of August 27, 2026, no active exploitation of either vulnerability had been reported, which is exactly the window where patching matters most, before proof-of-concept exploit code starts circulating and turns a theoretical risk into an active one.
What to Actually Do
Patched versions are available in Next.js v16.3.3 (the current Active LTS line) and v15.5.24 (Maintenance LTS, for anyone still on the 15.x branch). Updating means running your package manager’s normal update process (npm update next or the equivalent for yarn/pnpm), rebuilding, and redeploying, not a server-level configuration change. If a full update isn’t immediately possible, disabling AVIF support in next.config.js removes that specific attack surface as a stopgap, though it’s a workaround, not a substitute for actually patching.
The harder case is a site nobody’s actively maintaining anymore, a project a freelancer built two years ago that’s been left running untouched since. Those sites are exactly the ones least likely to get patched promptly and most likely to still be internet-facing, and they’re a real, if unglamorous, category of risk: software nobody’s watching doesn’t stop being a target just because nobody’s looking at it. If that describes a site you’re responsible for, this release is a reasonable prompt to check what version it’s actually running, not assume it’s fine because nothing’s broken yet.
Why This Keeps Happening
Modern JavaScript frameworks pull in a deep dependency tree, and a vulnerability in a library several layers down (like libheif here) becomes the framework’s problem the moment it’s bundled into a widely-used feature like image optimization. That’s not a Next.js-specific failure, it’s the tradeoff of using a modern framework with rich built-in functionality instead of hand-rolling everything: you inherit the framework’s own dependencies’ security posture along with its convenience. Staying on a current, actively-maintained Next.js version rather than an old pinned release is the practical mitigation, since security patches for the framework’s dependencies flow through framework updates, not something a site owner can address independently.