Vercel patches two critical Next.js flaws that let attackers run code on servers

What happened

Vercel released a security update for Next.js on August 25, 2026. It fixes two critical flaws, and each one lets an attacker run code on a server without logging in. The Cloud Security Alliance (CSA) describes Next.js as a widely used framework for building web applications.

Vercel had announced the update the week before. On the release day it moved the release forward after finding an additional critical flaw in one of the outside components Next.js depends on, according to the Next.js security release post.

The two flaws are unrelated. In its research note, the CSA said they share a release date but have different root causes.

Who is affected

The first flaw, CVE-2026-75604, affects Next.js sites running on Windows servers. Vercel rated it critical, with a score of 9.0 out of 10, in its advisory GHSA-p293-qw3h-jr36. It affects apps that use the Pages Router, or the App Router without the Cache Components feature. Servers running Linux or macOS are not affected, according to Vercel. The affected versions run from 13.4 through 15.5.23 and from 16.0 through 16.3.2.

The second flaw is in libheif, an image library that Next.js uses through an image-processing package called sharp. An attacker can trigger it when a Next.js site optimizes an AVIF image the attacker supplied. AVIF is an image file format. Vercel rated this flaw critical, with a score of 9.5 out of 10, in a separate advisory, GHSA-2xp9-vwfh-vxw4. It affects Next.js from version 10.0.0 up to the fixed releases.

The underlying libheif flaw is tracked as CVE-2026-84383. It affects libheif 1.22.0 through 1.23.1 and is fixed in libheif 1.23.2, according to the libheif advisory.

The CSA cited roughly 45 million weekly downloads of Next.js from npm, a public registry of JavaScript software packages. It said this made fast, wide-scale scanning and exploitation attempts likely.

Fixes and response

Next.js 15.5.24 and 16.3.3 fix both flaws. For the image flaw, the fixed versions no longer resize or optimize AVIF images. They serve those images unchanged until a fixed version of libheif is available, according to Vercel's changelog.

Sites hosted on Vercel's own platform are protected and need no action, Vercel said. The company turned off AVIF optimization across its managed image service once it learned of the image flaw. Its Next.js runtime uses Linux, so the Windows flaw does not apply.

A public proof of concept for the Windows flaw was posted to GitHub on the day of disclosure, according to the CSA. A proof of concept is code that shows a flaw can be exploited.

Fastly and Cloudflare added rules to their web application firewalls (WAFs), services that filter malicious web requests before they reach a site. Fastly added a virtual patch for CVE-2026-75604. Cloudflare's emergency WAF release covered both flaws.

The CSA reported no confirmed attacks using either flaw as of August 27, 2026.

Vercel credited the researchers evolutionstorm and B0RI with reporting the Windows flaw, and the Hacktron team with reporting the image flaw.

What organizations should do

Vercel advises self-hosted Next.js applications to upgrade to a fixed version. Sites on Next.js 15 or earlier should move to 15.5.24, and sites on Next.js 16 to 16.3.3. Vercel says there is no workaround for the Windows flaw and that affected servers should upgrade immediately.

The CSA recommends that organizations running Next.js in production check within 24 hours which version they run and whether it falls in either affected range. It advises teams on Windows to treat CVE-2026-75604 as the higher priority and not to rely on network-level protections alone in place of patching.

For sites that cannot update right away and have AVIF optimization turned on, the CSA recommends turning it off in the Next.js configuration as a temporary measure.