Next.js August 2026 fixes: CVE-2026-75604 Windows RCE and separate AVIF issue

BREAKING: Next.js unauthenticated RCE in image optimization and Windows servers (CVE-2026-75604)

Vercel shipped two critical Next.js fixes on 2026-08-25 in the same 15.5.24 / 16.3.3 cut, but they are separate vulnerabilities. CVE-2026-75604 is the Windows-only incremental-cache path traversal. The AVIF Image Optimization issue is separate and does not use CVE-2026-75604. Current CVE records place the Windows issue in Next.js versions >=13.4.0 and <15.5.24, plus >=16.0.0 and <16.3.3.

Who is not in scope

Skip the pager if any of these hold:

• The app is hosted on Vercel. Vercel disabled AVIF on managed Image Optimization after identification, and the Vercel Next.js runtime is Linux, so neither path is customer-action for platform-hosted apps.
• The Node process that serves Next.js is on Linux or macOS. CVE-2026-75604 is Windows filesystem only.
• Image Optimization is off, or AVIF never reaches the optimizer (not in images.formats, and you do not otherwise send AVIF through the optimizer). That takes you off the AVIF / libheif path.
• The Windows host is Pages-only or App-only, or Cache Components are on. CVE-2026-75604 needs both pages/ and app/ without Cache Components.
• You already run [email protected] or [email protected].

The AVIF bug reaches farther back than the Windows bug. Image Optimization AVIF RCE covers next >= 10.0.0 and < 15.5.24, and 16.x before 16.3.3. CVE-2026-75604 starts at 13.4. A 12.x or 13.3 self-hosted box can still be on the AVIF path even though it is not on the Windows router path.

What broke

Image Optimization AVIF (GHSA-2xp9-vwfh-vxw4, no CVE). Next.js image optimization uses sharp, which uses libheif. Upstream libheif GHSA-g89c-p67h-r497 is a heap overflow in scale_nearest_neighbor() when a crafted AVIF/HEIF file presents duplicate Alpha planes from nested iden/auxl items. Affected libheif is <= v1.23.1; patched is v1.23.2. When Image Optimization processes an attacker-controlled AVIF, that overflow is unauthenticated RCE in the Next.js process. Credit: Hacktron team.

The Next.js patched releases do not ship a new libheif. They disable AVIF optimization and serve AVIF as-is until an upstream fix propagates. Vercel did the same on managed Image Optimization. Patching libheif to 1.23.2 on the host does not replace the Next.js upgrade, and the Next.js upgrade does not replace a later libheif fix if you still want AVIF optimization back.

Windows unauthenticated RCE (CVE-2026-75604 / GHSA-p293-qw3h-jr36). Applications that use both the Pages Router and the App Router without Cache Components can hit unauthenticated RCE when the Next.js server uses a Windows filesystem. Linux and macOS are not affected. The current CVE record describes a CWE-22 path traversal affecting Next.js >=13.4.0 and <15.5.24, plus >=16.0.0 and <16.3.3. Fixed releases are 15.5.24 and 16.3.3. Vercel runtime is Linux, so platform-hosted apps are not on this Windows path.

What this is not

This is not a Vercel platform breach. It is not one bug. CVE-2026-75604 is not the AVIF / libheif bug. The Next.js patch does not fix libheif; it turns AVIF optimization off. Installing libheif 1.23.2 does not replace [email protected] or [email protected]. We are not claiming CISA KEV listing or in-the-wild exploitation; that status is unknown.

How to check

Confirm the package the running process actually loaded:

npx next --version
# or
npm ls next

Expect a line below 15.5.24 on the 15.x (or earlier) train, or below 16.3.3 on the 16.x train, unless you already patched. Then check the host OS of the Node process that serves the app, not the laptop you deploy from. CVE-2026-75604 is about the Windows filesystem on that server.

node -p process.platform
# win32 = Windows. linux and darwin are out of scope for CVE-2026-75604.

Look at repo layout and Cache Components:

ls -d pages app 2>/dev/null
# both present is the 75604 layout. Pages-only or App-only is not.
# Cache Components on takes you off 75604 even on Windows.

Check whether AVIF goes through the optimizer:

# next.config.js / next.config.mjs / next.config.ts
# images.formats includes image/avif, or you otherwise send AVIF into Image Optimization.
# If the optimizer is disabled, or AVIF is not in formats and never processed, GHSA-2xp9 is not on that path.

How to fix

npm install [email protected]   # 15.x or earlier
npm install [email protected]    # 16.x

Same commands close both issues. After upgrade, AVIF is served as-is (no resize, no optimization) until upstream libheif is in the sharp stack. There is no workaround for the Windows bug; if process.platform is win32 and both routers are in play without Cache Components, upgrade before you do anything else.

Use the current CVE record together with the Next.js August 2026 security release and Vercel changelog when checking scope and fixed versions. Keep CVE-2026-75604 separate from the AVIF Image Optimization issue.

References

• Next.js August 2026 security release
• Vercel changelog: Next.js August 2026 security release
• GHSA-p293-qw3h-jr36 (Windows RCE / CVE-2026-75604)
• GHSA-2xp9-vwfh-vxw4 (Image Optimization AVIF RCE)
• Upstream libheif GHSA-g89c-p67h-r497
• CVE-2026-75604 (Reserved)