A patch that arrived early
Vercel had already flagged an August 2026 security release for Next.js, the React framework used to build a large share of the web's production sites. On 25 August the release landed several days ahead of its original schedule, after the team found a second critical flaw in a dependency at the last minute. The fix shipped as two version bumps: Next.js 15.5.24 for anyone on the Maintenance LTS (long-term support) track, and 16.3.3 for anyone on Active LTS.
Next.js is pulled from the npm package registry more than 45 million times a week, according to SecurityOnline.info's reporting on the release, which is why a pair of unauthenticated, critical-severity bugs in it matters well beyond its own user base.
The Windows-only path traversal bug
The more serious of the two flaws is tracked as CVE-2026-75604 (GHSA-p293-qw3h-jr36) and carries a CVSS (Common Vulnerability Scoring System) score of 9.0 out of 10. It's a path traversal vulnerability, catalogued under CWE-22 (Common Weakness Enumeration), that allows an attacker with no credentials at all to execute arbitrary code on the server.
Three conditions narrow the exposure:
- The application combines the Pages Router and the App Router in the same project.
- Cache Components is not enabled.
- The server is hosted on Windows. Vercel's advisory states Linux and macOS deployments are not vulnerable to this specific bug.
That last point is the one that raises the stakes: there is no configuration workaround for it. The only fix is upgrading. And the threat isn't hypothetical - a working proof-of-concept exploit, built and tested against Next.js 16.2.11, is already public on GitHub under the handle rafabd1.
The AVIF image bug
The second flaw sits a layer further down the stack, inside libheif, an image-decoding library that Next.js pulls in indirectly through the sharp image-processing package. It triggers when the built-in Image Optimization API is handed an attacker-supplied AVIF (AV1 Image File Format) image, and like the routing bug, it allows remote code execution without authentication (tracked as GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497).
Because the root cause lives in libheif rather than in Next.js's own code, there isn't a clean fix yet. The 15.5.24 and 16.3.3 releases work around it by disabling AVIF image optimization entirely, and that will stay off until libheif ships its own correction upstream.
Who's already covered, and who isn't
Vercel says applications it hosts are automatically protected: its infrastructure runs on Linux, which sidesteps the routing bug by default, and it has disabled AVIF optimization platform-wide. Fastly has separately published a virtual patch for CVE-2026-75604 covering traffic that passes through its network.
Neither of those protections extends to anyone self-hosting Next.js. If you run your own servers - and particularly if any of them run Windows, or mix the Pages Router with the App Router - this update is not something to schedule for the next maintenance window.
What to do now
- Check your installed version. Anything below 15.5.24 on Maintenance LTS, or below 16.3.3 on Active LTS, needs upgrading.
- If you self-host on Windows, treat this as urgent. Public exploit code for CVE-2026-75604 is already circulating.
- If your app uses AVIF images through Next.js's Image Optimization API, expect that feature to stop working after the patch until libheif fixes the underlying issue - plan for it rather than being caught out in production.
- If you're behind Vercel or Fastly, confirm you're actually covered by their stated protections rather than assuming it by default, especially for non-standard deployment setups.
Why it matters
A framework with tens of millions of weekly downloads just shipped fixes for two unauthenticated, critical remote-code-execution bugs, and one of them already has a working public exploit. That combination - no login required, critical severity, proof-of-concept in hand - is precisely the profile that draws automated scanning within days of a disclosure like this. Anyone running Next.js outside Vercel's own infrastructure should treat this week's release as something to deploy now, not something to queue up.
The pattern behind the timing
What stands out about this release isn't just the severity of the two bugs, it's how the disclosure timeline played out. Vercel had already signalled that an August security release was coming, then moved the date forward once a second critical issue turned up in a dependency during final review. That sequence points to a security process that caught the AVIF bug internally before it went public, which is the outcome you want, but it also means the routing bug, CVE-2026-75604, had already reached the point where an outside researcher could build and publish a working exploit before most self-hosted deployments had a chance to patch. The gap between disclosure and exploitation getting shorter is a broader trend across the JavaScript ecosystem, not unique to Next.js, and it's part of why security teams increasingly treat framework-level advisories with the same urgency as operating-system patches rather than routine dependency bumps.
