Next.js 15.5.24 and 16.3.3 close two critical RCE paths

Next.js users have two critical unauthenticated remote-code-execution paths to assess. The framework team published patched releases 15.5.24 and 16.3.3 on August 25, 2026. One issue affects a specific Windows-hosted router configuration; the other reaches the Image Optimization API when attacker-controlled AVIF content is processed.

Cloudflare added emergency WAF coverage on August 26, including a new rule for the AVIF path. That gives defenders a network-layer signal, but it is not a substitute for upgrading the application. Neither the Next.js advisory nor the corroborating material reviewed confirms exploitation in the wild.

The Windows-hosted Next.js RCE

The advisory tracks the first issue as CVE-2026-75604, with GHSA-p293-qw3h-jr36. It is a path-traversal weakness that can become unauthenticated remote code execution when an application runs on a Windows filesystem, uses both the Pages Router and App Router, and does not use Cache Components.

Affected ranges are Next.js 13.4 through versions below 15.5.24, and 16.0 through versions below 16.3.3. The project rates the vulnerability Critical with a CVSS 3.1 score of 9.0. The advisory lists no known workaround for affected Windows-hosted applications, so internet-facing deployments matching the configuration should be treated as immediate patch targets.

The AVIF image-optimization path

The second issue, GHSA-2xp9-vwfh-vxw4, affects the Image Optimization API when it handles crafted AVIF images. The vulnerable path involves the native image-decoding dependency chain reached through sharp and libheif. Cloudflare describes the consequence as unauthenticated RCE and added a blocking WAF rule for the condition.

The practical exposure depends on configuration: AVIF optimization must be enabled and attacker-controlled AVIF data must reach the optimization endpoint. The patched Next.js releases disable AVIF optimization while the corrected upstream dependency propagates. Teams should verify whether their application explicitly enables image/avif, accepts remote or user-controlled images, or uses a proxy that can route untrusted content into the optimizer.

What operators should verify now

First, identify the version actually running in each deployed build; a corrected package.json does not prove that an older image or serverless artifact is gone. Then inventory Windows-hosted applications and check whether both router types are present without Cache Components. Separately, review Image Optimization settings, remote image sources, and any AVIF-related format configuration.

Upgrade to 15.5.24, 16.3.3, or a later fixed release. If an emergency deployment cannot happen immediately, use Cloudflare's WAF protections where available and restrict untrusted image inputs, but keep those measures temporary. Monitor application and reverse-proxy logs for unusual traversal attempts, unexpected image-worker failures, filesystem access, or child-process creation.

Evidence and limits

The Next.js GitHub advisory is the primary source for affected versions, configuration, severity, and remediation. Cloudflare's August 26 changelog independently confirms the emergency response and the two protected attack paths. The evidence supports urgent remediation; it does not support claiming a confirmed active campaign or universal exposure across all Next.js deployments.