next.js security rce self-hosted image-optimization

Next.js August 2026 vulnerabilities patched

Two critical RCE vulnerabilities in Next.js 15.x and 16.x require immediate upgrades for self-hosted apps; Vercel-hosted apps are already protected.

Summary

Self-hosted Next.js deployments face unauthenticated remote code execution via AVIF image processing and Windows filesystem paths. Vercel customers see zero operational overhead, but self-hosted teams must upgrade or disable AVIF handling immediately.

Why it matters

Implementation verdict

For Vercel deployments: nothing required, AVIF disabled server-side. For self-hosted: upgrade to next@15.5.24 (15.x) or next@16.3.3 (16.x) without workaround for Windows variant—patched versions serve AVIF as-is pending libheif fix. Action required now if self-hosted on Windows.

Sources

1.Applications hosted on Vercel are protected. No upgrades, configuration changes, or redeploys are required.
2.can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input
3.can lead to unauthenticated remote code execution on Windows-hosted Next.js servers
4.AVIF images are not resized or optimized. They are served as-is until a fixed libheif version is available.

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs