Next.js Patches Two Critical RCEs: Update Now
Vercel patched two critical unauthenticated RCE flaws in Next.js 15 and 16: one triggered by crafted AVIF images, another affecting Windows-hosted servers. No workaround exists for the Windows flaw — patch to 15.5.24 or 16.3.3.
Marisol "Fuse" DelgadoVercel released Next.js versions 15.5.24 and 16.3.3 on August 25, 2026, patching two critical unauthenticated remote code execution vulnerabilities. Both flaws affect a wide range of Next.js deployments; one of them has no workaround on the affected platform.
The two flaws
GHSA-2xp9-vwfh-vxw4 — AVIF Image Optimization RCE
A heap buffer overflow in the underlying libheif library can be triggered by a crafted AVIF image file submitted through Next.js’s image optimization API. The issue involves nested identity-derivation and auxiliary item references that cause 16-bit values to be written to an 8-bit allocation, resulting in memory corruption and remote code execution. Exploitation does not require authentication.
Affected: Next.js 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2.
GHSA-p293-qw3h-jr36 — Windows Server Path Traversal RCE
A path traversal vulnerability in Next.js applications running on Windows filesystems allows unauthenticated remote code execution. Both Pages Router and App Router deployments without Cache Components are affected. Vercel’s advisory is explicit: there is no known workaround for Windows-hosted applications.
Affected: Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2 on Windows server deployments.
Exploitation status
No active exploitation of either flaw has been confirmed as of August 27, 2026, per The Hacker News. However, a proof-of-concept demonstrating the AVIF heap corruption is circulating — which compresses the patch window for teams relying on “no known exploitation” as justification to defer.
What to do
Update to Next.js 15.5.24 (Maintenance LTS) or Next.js 16.3.3 (Active LTS). There is no version below 15.5.24 that is patched; versions 13.4 through 15.5.23 all require an upgrade.
If your deployment is Windows-hosted and you cannot patch immediately, there is no vendor-provided mitigation — escalate the patch priority accordingly.
If your deployment is Linux-hosted, your exposure to GHSA-p293-qw3h-jr36 is limited. You are still exposed to the AVIF flaw if image optimization is enabled and accepts external input.
Priority call
The Windows RCE warrants urgent attention for any Windows-hosted Next.js deployment: no workaround, no CVE mitigation path, no alternative — update the framework. The AVIF flaw is also critical and should be patched immediately regardless of platform, particularly for deployments where the image optimization endpoint is externally reachable.
See also: StackGres CVSS 9.9 tenant privilege escalation and NodeBB’s eight AI-found high-severity flaws for other recent critical web framework and cloud backend patches worth stacking in your queue.
Found this useful? Share it.
