Vercel Applications Protected from Next.js Security Vulnerabilities of August 2026

Two critical vulnerabilities were disclosed in the Next.js security release of August 2026. Next.js applications hosted on Vercel are already protected, so no additional actions such as upgrades or redeployments are required on the customer side.

The disclosed vulnerabilities are as follows:

• GHSA-2xp9-vwfh-vxw4: Originates from the upstream dependency libheif and can cause unauthenticated remote code execution (RCE) when Image Optimization processes manipulated AVIF inputs.
• CVE-2026-75604 (GHSA-p293-qw3h-jr36): Can cause unauthenticated remote code execution for applications using Pages Router and App Router (without cache components) on servers using Windows file systems.

Vercel disabled AVIF optimization in its managed Image Optimization service immediately upon identifying the AVIF vulnerability. AVIF inputs are now served as-is without going through the processing pipeline. The second vulnerability only affects Windows file systems, and Vercel's Next.js runtime uses Linux, so it is not affected by this vulnerability.

If you are using self-hosted Next.js applications, you must upgrade to the patched versions.

• Next.js 15.x and below: npm install [email protected]
• Next.js 16.x: npm install [email protected]

In the patched releases, AVIF images are served as-is without being resized or optimized until a fixed version of libheif is available. There is no workaround for the Windows vulnerability, so affected servers must be upgraded immediately.