What happened
Next.js disclosed two critical vulnerabilities in its August 2026 security release. The first, GHSA-2xp9-vwfh-vxw4 (CVSS 9.5), lives in the upstream libheif dependency and can allow unauthenticated remote code execution when Image Optimization processes a crafted AVIF file. The second, CVE-2026-75604 (CVSS 9.0), affects Next.js servers hosted on Windows using the Pages Router or App Router without Cache Components, and also allows unauthenticated remote code execution. Vercel says it disabled AVIF optimization across its managed Image Optimization service as a precaution, and that the Windows-specific flaw doesn't apply to its Linux-based infrastructure, so Vercel-hosted apps needed no customer action.
Why it matters for your business
If your Next.js app is self-hosted on Windows, this isn't a patch to schedule for next sprint — there is no workaround, and the fix requires upgrading to Next.js 15.5.24 or 16.3.3. If you're hosted on Vercel, protection was already applied platform-side, but it's still worth confirming your deployed Next.js version is current, since the underlying vulnerabilities exist in the framework regardless of where AVIF optimization currently sits.
What to watch next
Expect continued patch releases as the libheif dependency issue works through the ecosystem; teams running Next.js on other Windows-hosted infrastructure, not just self-managed servers, should treat this as an immediate-upgrade item.