Two critical Next.js RCE flaws are fixed in 15.5.24 and 16.3.3

Next.js released versions 15.5.24 and 16.3.3 on August 25 to address two critical vulnerabilities that can permit unauthenticated remote code execution. Self-hosted deployments need attention, while Vercel and Netlify say their managed environments do not expose the affected execution paths.

Key takeaways

• GHSA-2xp9-vwfh-vxw4 affects Next.js image optimization when a crafted AVIF file reaches the vulnerable libheif path.
• CVE-2026-75604 affects specified Windows-hosted applications using the Pages Router or the App Router without Cache Components.
• Patched releases are Next.js 15.5.24 and 16.3.3.
• Vercel-hosted applications require no customer action for these flaws, but self-hosted users should upgrade and redeploy.

The two Next.js attack paths

GHSA-2xp9-vwfh-vxw4 originates in libheif, used through Sharp by Next.js Image Optimization. The advisory gives it a 9.5 CVSS v4 score and says remote code execution can occur when the server optimizes a malicious AVIF input. Affected ranges include Next.js 10.0.0 through releases earlier than 15.5.24, plus Next.js 16 releases earlier than 16.3.3.

CVE-2026-75604, tracked by GHSA-p293-qw3h-jr36, affects Windows-hosted Next.js servers. Netlify’s summary lists affected ranges as 13.4.0 through releases earlier than 15.5.24 and Next.js 16 releases earlier than 16.3.3. The vulnerable configurations use the Pages Router or the App Router without Cache Components.

What the patches change

The fixed releases are 15.5.24 for the Maintenance LTS line and 16.3.3 for Active LTS. Until the upstream libheif fix has propagated, these releases disable AVIF optimization: AVIF files are served without being resized or optimized.

That behavior change may affect image bandwidth or performance assumptions, but staying on an exposed release is the larger risk. The Next.js guidance says there is no workaround for the Windows vulnerability, making an upgrade necessary for affected servers.

Managed hosting versus self-hosting

Vercel says applications hosted on its platform are protected. It disabled AVIF processing in the managed Image Optimization service, and its Next.js runtime uses Linux rather than the affected Windows filesystem path.

Netlify says its functions run on Linux and that requests to /_next/image are rewritten to Netlify Image CDN, bypassing the vulnerable Next.js optimizer. Netlify still recommends upgrading to a patched framework release.

These platform statements do not automatically cover custom containers, dedicated Windows servers, hybrid deployments, or an image optimizer running outside the provider’s managed path. Operators should verify the path their production traffic actually uses.

Upgrade and verification checklist

Self-hosted Next.js 15 deployments should install next@15.5.24 or later. Next.js 16 deployments should install next@16.3.3 or later. Rebuild and redeploy the application so the patched package reaches every production instance, worker image, and rollback artifact.

Review whether untrusted users can supply AVIF images and whether any deployment runs on Windows. After deployment, confirm the resolved Next.js version from the production lockfile or artifact rather than relying only on the source manifest. Teams with exposed, previously vulnerable systems should retain request and process logs for follow-up investigation.

Source check

• Next.js August 2026 security release is the framework team’s primary release notice.
• GitHub advisory GHSA-2xp9-vwfh-vxw4 documents the AVIF image-optimization vulnerability and patched versions.
• Vercel’s deployment advisory explains its managed mitigations and self-hosted upgrade instructions.
• Netlify’s independent platform assessment corroborates both affected ranges and the required patched releases.