Vercel applications are protected from Next.js August 2026 security vulnerabilities
By Steven Van ·
Summary Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release.
Two critical vulnerabilities disclosed in Next.js's August 2026 security release affect Next.js applications, but Vercel says apps hosted on its platform are already protected and need no action.
- An AVIF-related flaw in the upstream libheif dependency (GHSA-2xp9-vwfh-vxw4) could allow unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. Vercel disabled AVIF optimization across its managed Image Optimization service, so AVIF inputs are now served as-is rather than passing through the affected code path.
- A second flaw, CVE-2026-75604 (GHSA-p293-qw3h-jr36), can lead to unauthenticated remote code execution on Windows-hosted Next.js servers using the Pages Router or App Router without Cache Components. Vercel's Next.js runtime uses Linux and isn't affected.
Self-hosted Next.js apps aren't covered by these protections and should upgrade directly: next@15.5.24 for Next.js 15.x or earlier, or next@16.3.3 for Next.js 16.x. In both patched releases, AVIF images are served unresized until a fixed libheif version ships. There's no workaround for the Windows vulnerability, so affected servers should upgrade immediately. Details are in the original announcement.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →