Emergency Next.js 15.5.24 and 16.3.3 Security Updates Explained

On August 25, 2026, Vercel released emergency updates Next.js 15.5.24 and 16.3.3 that fix two critical unauthenticated remote code execution (RCE) vulnerabilities. The first is a path traversal issue on servers with a Windows file system (CVE-2026-75604, CVSS 9.0), the second is a heap overflow when processing specially crafted AVIF images (CVSS v4: 9.5). There is no workaround for the Windows vulnerability — the only protection measure for self‑hosted applications is immediate updating. Applications on the Vercel platform are protected at the infrastructure level and do not require any user action.

CVE-2026-75604: path traversal on Windows

The vulnerability CVE-2026-75604 is classified as CWE-22 (improper limitation of a pathname to a restricted directory) and has been scored 9.0 under CVSS v3.1. It affects Next.js applications that simultaneously use both the Pages Router and the App Router without Cache Components and run on a server with a Windows file system.

Affected versions:

• Next.js from 13.4 up to and including 15.5.23
• Next.js from 16.0 up to and including 16.3.2

Deployments on Linux and macOS are not affected by this vulnerability. According to the Vercel advisory, there is no workaround for affected applications on Windows — immediate updating is required. The specific attack mechanism is not disclosed in the advisory. Discovery of the vulnerability is attributed to researchers evolutionstorm and B0RI.

Heap overflow via AVIF images

The second vulnerability (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5) is related to processing images in AVIF format. Next.js uses the sharp library for image optimization, and sharp in turn relies on the C library libheif to parse AVIF files.

The root cause is a heap overflow in libheif (CVSS v3.1: 9.8) in the image scaling function. A specially crafted AVIF file with nested references to derived identity items and auxiliary items causes libheif to create a decoded image with two alpha channel entries of different bit depths. The scaler allocates the destination buffer based on the size of the first 8‑bit entry, but then writes 16‑bit values from the second entry into the same buffer, overwriting approximately 16,384 bytes beyond the allocated region.

The affected versions for the AVIF vulnerability are significantly broader:

• Next.js from 10.0.0 up to and including 15.5.23
• Next.js from 16.0 up to and including 16.3.2
• libheif all versions up to and including 1.23.1

Researchers have published a public Python PoC exploit that reproduces heap corruption under AddressSanitizer. According to the researchers, they managed to achieve remote code execution on several applications; however, this claim has not been independently verified — the public PoC demonstrates only memory corruption.

An important mitigating factor: AVIF optimization in Next.js is enabled only if image/avif is explicitly added to the formats configuration in the next.config.js file. Deployments without this setting are not vulnerable.

Attribution discrepancy

There is a noteworthy discrepancy in the attribution of the AVIF vulnerability’s discovery. The Vercel changelog credits the disclosure to the Hacktron team, whereas the libheif advisory names rootxharsh as the discoverer of the vulnerability and KarimPwnz as the coordinator. The relationship between these names and the Hacktron team is not clarified in the primary sources.

Context: a growing wave of Next.js vulnerabilities

The August release is the second one under Vercel’s formal monthly security program, launched in July 2026. The company directly linked the creation of the program to increased vulnerability research across the industry, “fueled by LLM‑assisted discovery.” The first scheduled release in July fixed nine vulnerabilities, including denial of service, server-side request forgery, and middleware bypass.

Notably, Vercel brought the August patch release forward by one day — from August 26 to August 25 — after discovering an additional critical vulnerability in one of its upstream dependencies.

The patched Next.js releases fully disable AVIF optimization until a fix is available in the upstream libheif version. At the time the original source material was published, libheif version 1.23.2, designated as fixed in the advisory, had not yet been released.

Remediation recommendations

For self‑hosted Next.js applications:

1. Update immediately to the fixed versions:
   • npm install [email protected] — for the 15.x line and earlier
   • npm install [email protected] — for the 16.x line
2. Prioritize Windows servers: there is no workaround for CVE-2026-75604. If your application uses both routers on Windows, updating is the only protection measure.
3. Check your AVIF configuration: if image/avif is absent from the formats setting in next.config.js, your application is not exposed to the AVIF vulnerability. Nonetheless, updating is recommended to address both issues.
4. Account for AVIF optimization being disabled: after updating, AVIF files will be served without optimization until the fixed libheif version is released. This may impact image delivery performance.

Applications hosted on the Vercel platform are protected at the infrastructure level: the managed image optimization service has already disabled AVIF processing, and the Next.js runtime environment uses Linux, which eliminates the Windows vulnerability. No redeployment or updating by users is required.

Both vulnerabilities have either a public PoC exploit (for AVIF) or a detailed description of the attack vector, which makes the safe update window extremely narrow. Organizations with self‑hosted Next.js instances on Windows should treat updating as a top‑priority task, and all others should apply the updates in the next maintenance cycle without waiting for confirmation of active exploitation.