Next.js Ships Emergency Patches for Two Critical RCE Bugs

Vercel shipped Next.js 16.3.3 and 15.5.24 on 25 August 2026 to patch two critical severity vulnerabilities. The first is an unauthenticated remote code execution bug in AVIF image processing, triggered through a flaw in the underlying libheif and sharp libraries. The second is a Windows filesystem remote code execution bug affecting apps that use both the Pages and App Router without Cache Components enabled. AVIF optimisation is disabled by default until an upstream fix lands.

Unauthenticated remote code execution is about as serious as a web framework vulnerability gets: no login, no special access, just a request crafted to exploit an image processing pipeline that most Next.js sites run without a second thought. Image optimisation is one of those features that gets switched on and forgotten, which is exactly what makes a flaw in it so dangerous. Sites that have not touched their Next.js version in a while, or that pin dependencies tightly for stability, are the ones most exposed until they update.

If you are running Next.js in production, the practical move is simple and not optional: update to 16.3.3 or 15.5.24 immediately, and if you cannot update right away, disable AVIF image optimisation as an interim mitigation. Check whether your build actually serves AVIF images through the framework's own optimiser, since a lot of sites do this by default without anyone deciding to.

We run several client sites on Next.js, and this is a useful reminder of a discipline that is easy to let slip: a framework this widely used is also a framework this attractive to attack, and a security release deserves the same urgency as a client facing outage, not a "get to it next sprint" ticket. The AVIF flaw specifically is a good argument for keeping image optimisation pipelines simple enough that disabling one feature does not mean disabling the whole site.