# Vercel applications are protected from Next.js August 2026 security vulnerabilities By Steven Van · 2026-08-25 Summary Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Two critical vulnerabilities disclosed in Next.js's August 2026 security release affect Next.js applications, but [Vercel]() says apps hosted on its platform are already protected and need no action. - An AVIF-related flaw in the upstream libheif dependency (GHSA-2xp9-vwfh-vxw4) could allow unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. Vercel disabled AVIF optimization across its managed Image Optimization service, so AVIF inputs are now served as-is rather than passing through the affected code path. - A second flaw, CVE-2026-75604 (GHSA-p293-qw3h-jr36), can lead to unauthenticated remote code execution on Windows-hosted Next.js servers using the Pages Router or App Router without Cache Components. Vercel's Next.js runtime uses Linux and isn't affected. Self-hosted Next.js apps aren't covered by these protections and should upgrade directly: **next@15.5.24** for Next.js 15.x or earlier, or **next@16.3.3** for Next.js 16.x. In both patched releases, AVIF images are served unresized until a fixed libheif version ships. There's no workaround for the Windows vulnerability, so affected servers should upgrade immediately. Details are in the [original announcement](). [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() Sources [Original source]() [Read Vercel applications are protected from Next.js August 2026 security vulnerabilities on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-vercel-applications-are-protected-from-next-js-august-2026-security-vu