Vercel has fixed two critical vulnerabilities in the Next.js JavaScript framework with its August update. Both flaws allow attackers to execute code on affected systems, potentially to steal data or compromise servers.
npm install next@15.5.24 # for 15.5
npm install next@16.3.3 # for 16.3The first vulnerability, rated 9.8 out of 10 on the CVSS scale, originates from the libheif library that Next.js uses for image optimization. It causes a heap buffer overflow in any application calling the library's heif_decode_image() method when processing AVIF images.
The second flaw, rated 9 out of 10 and tracked as CVE-2026-75604, affects Next.js installations running on Windows servers that use the Pages and App Router without a cache component. According to Vercel there is no workaround for this vulnerability. Affected versions are all releases before 15.5.24 and 16.3.3, and users are urged to update immediately.
The Vercel-hosted variant of Next.js is not affected, the company states, because it does not offer AVIF optimization and runs on Linux. Vercel switched to a monthly release cadence for security updates in July.
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.