Next.js Patches Two Critical RCEs: What Self-Hosted Teams Must Do

Marcus Chen Staff Engineer, Backend & Cloud, YuSMP Group · Runtime security and platform hardening for US/EU services

The short answer

What Vercel patched on August 25

Vercel pre-announced the release a week in advance, giving teams a runway to plan maintenance windows. The final release landed ahead of schedule after a second critical-severity vulnerability — the AVIF image flaw — was identified in an upstream dependency in the days before the planned date. Both fixes shipped together in the August 25 emergency release.

The two active LTS tracks are the patch targets. Next.js 16.3.3 is the current Active LTS and Next.js 15.5.24 is the Maintenance LTS, covering the two most widely deployed version families. Teams on older, end-of-life branches do not receive fixes; the recommended path is to migrate to a supported line before patching.

Vercel coordinates security disclosures through its Open Source Bug Bounty program on HackerOne. Both advisories were privately reported and fixed before public disclosure, which is why no proof-of-concept exploit code existed at the time of the announcement.

CVE-2026-75604: Windows path traversal RCE

The mechanics of CVE-2026-75604 are rooted in how Next.js handles route resolution when both the Pages Router and App Router are active. In that hybrid configuration — increasingly common as teams migrate from Pages Router incrementally — a path traversal bug in the Windows filesystem layer can be triggered without authentication. An attacker who can send a crafted HTTP request to the server can achieve arbitrary code execution under the process's identity.

The important scope restriction is the filesystem: this vulnerability is Windows-only. The Next.js advisory is explicit: "Linux and macOS are not affected by this issue." Many self-hosted Next.js deployments run on Linux containers, which narrows the real-world exposure. But teams that run the Next.js server process on Windows — whether on a VM, a Windows-based cloud instance, or a hybrid development pipeline that also has production surface — should treat this as a top-priority patch.

Critically, there is no known workaround for Windows-hosted applications. Disabling either router is rarely an option in a production hybrid setup. The patch is the only complete mitigation. Fastly has published a virtual patch for its WAF customers, and edge-level rules can reduce exposure in transit, but neither replaces upgrading the framework. Teams relying on application-layer security audits should note that static analysis will not catch a runtime path traversal of this kind — it requires an upgrade.

AVIF image optimization flaw

The second vulnerability (GHSA-2xp9-vwfh-vxw4) affects a different part of Next.js: the Image Optimization API. When a Next.js server processes an AVIF image using the sharp library, it relies on libheif for decoding. The flaw is a memory-safety bug in libheif itself — if an attacker can cause the server to decode a maliciously crafted AVIF file, they can achieve unauthenticated remote code execution on the host.

The attack surface for this flaw is broader than CVE-2026-75604. It is not limited to Windows, and any Next.js deployment that processes user-controlled images — whether from uploads, third-party URLs passed to the <Image> component, or an unvalidated remotePatterns configuration — is potentially in scope. The remotePatterns allowlist in next.config.js does constrain which remote URLs can be optimized, but a misconfigured or overly permissive allowlist could leave exposure.

Because the bug is in an upstream library rather than Next.js itself, the Vercel team chose a conservative mitigation: the patched versions of Next.js disable AVIF image optimization entirely until the fix propagates through the libheif release chain. AVIF images will still be served — they will simply not go through the optimization pipeline. Teams that depend on AVIF optimization for performance should plan to re-enable it once a patched libheif version is available and integrated into sharp.

Who is protected automatically?

Teams deploying on Vercel's managed platform do not need to take action — Vercel confirmed in its changelog that the platform is protected from both vulnerabilities. Vercel's infrastructure-level mitigations apply automatically to all hosted applications.

For everyone else, the answer is more nuanced. Self-hosted deployments on any platform — AWS, GCP, Azure, on-premises, Docker containers, bare-metal VMs — require a manual upgrade. The version of Next.js your application runs is determined by what is installed in node_modules, not by the hosting provider. If your CI pipeline does not pin and verify the framework version on every build, this is a good moment to add that check.

Edge runtimes and serverless functions that do not run a full Node.js Next.js server are not affected by CVE-2026-75604, because the path traversal occurs in the server process. The AVIF flaw is similarly confined to the Image Optimization API — if your deployment handles image optimization externally (via a CDN or a separate service), your surface area is smaller, but upgrading remains the right call.

What it means for US & EU software teams

For teams running Next.js in production, the primary question is operational: how long does it take to go from "there is a critical patch" to "all affected services are running the fixed version"? If your answer is measured in hours, this week looks manageable. If it is measured in weeks, that gap is the real risk — not just from this CVE, but from the next one.

The Windows-specific scope of CVE-2026-75604 is worth checking against your actual deployment. Many teams assume Linux containers, but mixed environments — where Next.js runs in a Node.js process on a Windows host for legacy reasons, or where a development-stage system has production-adjacent exposure — can catch teams off guard. An inventory of where Next.js actually runs in your environment is a useful deliverable from this incident regardless of whether you are immediately affected.

For teams in regulated industries, these disclosures also have a compliance angle. Frameworks like SOC 2, ISO 27001 and the EU's NIS2 directive expect a documented vulnerability-management process: how you monitor for advisories, how you triage severity, and what your patching SLA looks like. A critical RCE in a widely adopted open-source framework is a concrete test case. Demonstrating that you identified, triaged and patched within a defined SLA — and that you have logs to prove it — is exactly what an assessor wants to see.

How to patch this week

The path to a patched deployment is straightforward, but the details matter.

1. Check your Next.js version. Run npx next --version or inspect package.json across all your services. If you use Docker, check the base image build logs or inspect the container: docker exec <container> npx next --version.
2. Upgrade the framework. For the 15.x line: npm install next@15.5.24. For the 16.x line: npm install next@16.3.3. Commit the updated package-lock.json so CI enforces the version.
3. Rebuild container images. If Next.js is bundled into a Docker image, a dependency bump is not enough — rebuild the image from scratch so the new version is baked in. A running container will not self-update.
4. Verify AVIF behaviour. After upgrading, confirm that your image optimization pipeline behaves as expected. AVIF files will be served but not optimized in the patched versions; if you serve AVIF heavily, check your CDN hit rates and review whether WebP coverage is sufficient while the upstream fix propagates.
5. Audit your remotePatterns. While you are in the configuration, tighten any overly broad allowlist entries. The AVIF flaw requires the server to process a malicious image — a strict remotePatterns configuration limits which external image URLs can reach the optimizer.
6. Update your dependency scanning. Add Next.js version verification to your CI pipeline so that any future regression — a dependency update that downgrades the framework — is caught before it reaches production.

Frequently asked questions

Sources

Vercel / Next.js — August 2026 Security Release (official advisory, primary source)
Vercel Changelog — Next.js August 2026 security vulnerabilities (platform protection confirmation)
SecurityOnline — 45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated RCE
Endor Labs — Critical RCE Vulnerabilities in React and Next.js