August 2026 Security Release

Sebastian Silbermann,

Josh Story,

Karim Rahal

Last week we announced an upcoming security release for Next.js. Earlier today, we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies.

Updates are now available in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.

npm install [email protected]  # for 15.5
npm install [email protected]   # for 16.3

Copy link to headingImpact

Copy link to headingUnauthenticated Remote Code Execution in the Image Optimization API when using AVIF (Critical Severity)

GHSA-2xp9-vwfh-vxw4 / GHSA-g89c-p67h-r497

A vulnerability in the underlying libheif library used by

sharp

can lead to unauthenticated remote code execution when Next.js optimizes an attacker-controlled AVIF image. The patched releases disable AVIF optimization until an upstream fix is propagated.

Copy link to headingUnauthenticated Remote Code Execution on Windows-hosted servers (Critical Severity)

CVE-2026-75604 / GHSA-p293-qw3h-jr36

A vulnerability in applications using both the Pages Router and App Router without Cache Components can lead to unauthenticated remote code execution when the Next.js server uses a Windows filesystem. Linux and macOS are not affected by this issue. There is no known workaround for affected Windows-hosted applications.

Copy link to headingOur security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].