Next.js Rushes Out an Accelerated Security Release
Vercel moved a scheduled patch forward after finding a critical remote-code-execution flaw in an image-processing dependency.
Vercel published the Next.js August 2026 security release on August 25, moving its timeline forward twice in one week. The team had announced an upcoming release, then updated that announcement the same day to say the release itself was moving earlier after identifying an additional critical-severity vulnerability in an upstream dependency.
The release addresses two separate critical issues. The first is in libheif, a library used by the sharp image-processing package that Next.js relies on for its built-in Image Optimization API. Under the right conditions, an attacker-controlled AVIF image could trigger unauthenticated remote code execution when Next.js optimized it; the patched releases disable AVIF optimization entirely until an upstream fix in libheif is available.
The second issue, tracked as CVE-2026-75604, affects applications that use both the Pages Router and App Router without Cache Components enabled, and only on Windows-hosted servers — Linux and macOS deployments are not affected. Vercel says there is no workaround for affected Windows-hosted applications short of patching.
Fixes landed in Next.js 16.3.3, the current Active LTS line, and 15.5.24, the Maintenance LTS line. Teams on either line can update with a standard `npm install next@16.3.3` or `npm install next@15.5.24`.
This release capped a week-long escalation: Vercel first posted an announcement flagging an upcoming security release, then published an update the same day confirming the release itself had moved earlier after identifying the second critical-severity vulnerability in an upstream dependency. That kind of same-day acceleration is uncommon for a project that typically gives more advance notice ahead of a scheduled security release.
Vercel runs its Next.js security program through an open source bug bounty on HackerOne and publishes every advisory to its own security blog as it happens, which is where these two fixes, along with their GitHub Security Advisory IDs, are documented in full. Teams that can't patch immediately should note that the AVIF mitigation is a blanket one: optimization for that format stays off for everyone on the patched releases, not just for requests that look suspicious.