Next.js Pulled Its Security Release Forward a Day Because a Second Critical Showed Up. The One That Hits You Fires on an AVIF.
On 20 August, Vercel pre-announced a Next.js security release for 26 August addressing one critical vulnerability. On 25 August they published a second post moving it forward a day, because a second critical had turned up in the meantime, and they wanted people to upgrade once rather than twice. Versions 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS) landed that day.
Two criticals in one release is unusual. What is more unusual, and worth more of your attention than either bug, is that Vercel told everyone a critical was coming six days before the patch existed.
Up front: this site runs Astro, and I do not ship Next.js in production. So read this as a careful read of the advisories with an eye to which one actually reaches a solo operator's deployment, not as an incident report.
The two bugs are not equally dangerous to you
CVE-2026-75604, CVSS 9.0. A path traversal that reaches remote code execution when the server is hosted on a Windows filesystem. It affects apps using the Pages and App router without Cache Component. There is no workaround. You patch or you stay vulnerable.
The qualifier is doing enormous work there. Windows filesystem. If your Next.js app runs on Vercel, or on a Linux container, or on basically any of the deployment targets a solo operator reaches for, this one does not fire. The CVSS 9.0 is a fair score for the affected population and a misleading headline for everybody else.
The image optimization bug. A flaw in libheif, which sharp uses, triggered when the Image Optimization API optimizes an AVIF file. A crafted AVIF can run code on the server. Unlike the first bug, this one is not platform-conditional, and the mitigation available before patching is to disable AVIF optimization.
That is the one to care about. next/image is close to universal in Next.js apps, AVIF is in the default formats list for a lot of configurations, and the attacker input is a file, which means anything with a user upload path or a remote image pattern is potentially reachable.
I have seen one report putting the AVIF bug at CVSS 9.5, which would make it the more severe of the two, but I could only find that figure in secondary coverage rather than in the advisory itself, so treat the exact number as unconfirmed and the severity as "critical, patch it" regardless.
What to actually do, in order
# check what you're on npm ls next # patch npm install next@16.3.3 # or next@15.5.24 on the 15 line
If you cannot deploy today, turn off AVIF in next.config.js as a stopgap:
module.exports = {
images: {
formats: ['image/webp'],
},
};
That removes the trigger for the second bug. It does nothing for the Windows one, which has no workaround, so if you are on a Windows host the only move is to upgrade.
Then check the thing everybody forgets: your lockfile pins sharp transitively. Run npm ls sharp and confirm you actually picked up whatever version the Next.js patch expects, because a stale transitive pin is exactly how a patched framework version ships with an unpatched dependency underneath it.
The pre-announcement is the real story
Vercel started a formal security release program in July. The August cycle is the one where you can see what it buys you: a post on 20 August saying "a critical is coming on the 26th, plan your upgrade window," then a post on the 25th saying "make that the 25th, there are two now."
I have gone back and forth on whether that is good practice. The argument against is obvious. You have told every attacker on earth that there is a critical bug in a framework with over 45 million weekly npm downloads, and given them six days to go looking for it before a patch exists. Diffing a patch is fast; hunting blind for six days with a confirmed target is a real head start.
The argument for is that it is honest about a thing that was already true. Vulnerability details leak, researchers coordinate across vendors, and the population that benefits most from advance notice is the one that cannot deploy on an hour's notice: teams with change windows, compliance sign-off, or a single person who might be on a plane on the 26th.
I have come round to thinking the pre-announcement is correct, mostly because of what happened this cycle. The date moved. A shop that had scheduled an upgrade window for the 26th found out on the 25th that it needed to move, and had a reason to look. Without the program, they would have found out whenever they next read a changelog.
Where I could be wrong about all of this
The strongest case against my "the Windows bug does not affect you" framing is that I do not know your deployment. Windows hosting for Node applications is less rare than the indie hacker bubble assumes. It is common in enterprises, common in .NET-adjacent shops that picked up a Next.js frontend, and common in self-hosted setups on a Windows VPS someone provisioned in 2021 and never revisited. If you inherited a deployment, check the host before you conclude the 9.0 is somebody else's problem.
The weaker case, but the one I would actually bet on being raised, is that pre-announcing criticals is net negative and this cycle just got lucky. I do not have data either way, and neither does anyone else yet, because the program is two months old. Ask again in a year.
The part where I am smug about static sites, briefly
Neither of these bugs has a surface on this blog, because there is no server. Astro builds to dist/, nginx serves the files, and the image optimization happens once at build time on my machine rather than on demand in response to a request. A path traversal needs a request handler to traverse. A malicious AVIF needs an endpoint willing to optimize it.
That is not an argument that you should rewrite your Next.js app. Static output is the wrong shape for most products, and the reason I get to be smug here is that a personal blog is the easiest possible case. It is an argument for being clear-eyed about what dynamic rendering costs you: every image optimizer, every route handler, and every runtime dependency is surface, and surface has a patch cadence attached to it.
If you run Next.js, the recommendation is boring and unchanged. Upgrade to 16.3.3 or 15.5.24 today, check npm ls sharp, and if you are not already subscribed to the Next.js security tag, do that now, because the next pre-announcement will be more useful to you than this post was.
Author
Lukas
@lukcombinator