Vercel confirmed on August 20 that Next.js will ship a scheduled security release on August 26, 2026, patching one critical-severity vulnerability. The fix lands in versions 16.3.3 and 15.5.24, according to the official Next.js blog. No CVE number or technical detail has been published yet; Vercel says the full advisory, including affected routes and upgrade instructions, goes live alongside the patch itself.
Update – August 26, 2026
Vercel moved this release forward a day, from August 26 to August 25, after identifying a second critical-severity issue late in the process. The patched versions, 16.3.3 and 15.5.24, are live, and two critical vulnerabilities are now documented instead of the one originally announced.
The first is an unauthenticated remote code execution flaw in the Image Optimization API when AVIF files are processed (GHSA-2xp9-vwfh-vxw4), rated critical with a CVSS score of 9.5. It traces back to a bug in libheif, the library sharp uses for image decoding, and affects next versions 10.0.0 up to 15.5.24 and anything before 16.3.3. No CVE number has been assigned to this one yet. Until the patch reaches every app, Vercel has disabled AVIF optimization as a stopgap.
The second, tracked as CVE-2026-75604, is an unauthenticated RCE affecting Windows-hosted Next.js servers running the Pages or App Router without Cache Component. It comes from improper pathname validation, a path traversal issue (CWE-22), rated critical at CVSS 9.0, and hits versions 13.4 through 15.5.24 and 16.0 through 16.3.3. Vercel says there is no workaround for affected Windows deployments, so upgrading is the only fix.
Anyone running Next.js in production, especially on Windows hosting or with AVIF image optimization enabled, should update to 16.3.3 or 15.5.24 now rather than waiting.
Part of a new, more predictable release cadence
This is the second release under Next.js’s new security release program, announced in July after the team moved away from shipping ad-hoc patches with zero advance warning. The first scheduled release, on July 21, patched four high and five medium severity issues in versions 16.2 and 15.5. Vercel says the shift followed a sharp rise in vulnerability research driven by LLM-assisted discovery tools, the same class of tooling that surfaced 271 issues in a single Firefox release earlier this year.
Going forward, Vercel plans to publish one of these advance notices roughly every month, each naming the release date and the worst severity it will contain. Anything urgent, or already being exploited, still gets patched immediately outside the schedule, the way React2Shell was handled last December.
What Next.js teams should do before August 26
Since no CVE or affected-surface detail is public yet, there’s nothing to patch today. But teams running Next.js in production, especially anything on the 16.x or 15.5.x line, should plan to update as soon as 16.3.3 or 15.5.24 land. A few things worth doing now:
- Check which Next.js version your production apps are actually running, not just what’s pinned in package.json.
- Have a deploy pipeline ready that can ship a patch release same day. “Critical” severity from Vercel has meant real, exploitable issues before.
- If you’re not already on 16.2 or 15.5 or later, catch up before August 26 so the upcoming patch applies cleanly.
For teams that don’t have the bandwidth to track framework security releases on their own calendar, this is exactly the kind of maintenance gap that shows up during a web application development audit, usually right before it becomes a real problem. It matters even more for SaaS products built on Next.js, where a delayed patch means a delayed fix across every customer at once.
Sources
- Upcoming Next.js August Security Release (Next.js Blog)
- Next.js Security Release and Our Next Patch Release (Next.js Blog)
- Update: August Next.js Security Release (Next.js Blog)
- GHSA-2xp9-vwfh-vxw4: Unauthenticated RCE in Image Optimization API (GitHub Security Advisory)
- CVE-2026-75604: Unauthenticated RCE on Windows-hosted Servers (GitHub Security Advisory)
