# Security Update: Two critical Next.js vulnerabilities

By Steven Van · 2026-08-25

The Next.js team has disclosed two critical severity vulnerabilities, both of which can lead to unauthenticated remote code execution.

[**Netlify**](<https://creatorstoolbox.com/tools/netlify>) announced [**Security Update: Two critical Next.js vulnerabilities**](<https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/>) on August 25, 2026.

## What changed

The Next.js team has disclosed two critical severity vulnerabilities, both of which can lead to unauthenticated remote code execution. Both are patched in 15.5.24 and 16.3.3. Netlify-hosted sites are not affected by the Windows issue, and do not run the Next.js code path affected by the image issue. We still recommend upgrading. Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: CVE-2026-75604 / GHSA-p293-qw3h-jr36 — Unauthenticated remote code execution on Windows-hosted servers Severity: Critical Affected versions: ≥13.4.0 next 15.5.24 or later, or 16.3.3 or later, then redeploy. Resources Next.js August 2026 security release Next.js security advisories

[![](<https://www.netlify.com/images/og-image-default.png>)](<https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/>)

![Netlify](<https://www.google.com/s2/favicons?domain=netlify.com&sz=128>)

Netlify

Lightning-fast web platform for deploying, hosting, and scaling modern sites — one-click deploys from Git or any modern AI builder.

[View Netlify →](<https://creatorstoolbox.com/tools/netlify>)

Sources

[Original source](<https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/>)

[Read Security Update: Two critical Next.js vulnerabilities on Creators Toolbox](<https://creatorstoolbox.com/blog/netlify-security-update-two-critical-next-js-vulnerabilities>)

---
Canonical source: https://creatorstoolbox.com/blog/netlify-security-update-two-critical-next-js-vulnerabilities