On August 25, 2026, Next.js released an update that fixes two Critical vulnerabilities capable of leading to remote code execution (RCE). The safe releases are Next.js 16.3.3 on Active LTS and 15.5.24 on Maintenance LTS. If your application runs on Windows or processes AVIF images through the built-in optimizer, treat this update as urgent.
Quick answer: if you already use Next.js 16, upgrade to 16.3.3; if you need to remain on version 15, install 15.5.24. Editing package.json is not enough: update the lockfile, rebuild the application, deploy a new artifact, and confirm the version actually running in production.
What changed in Next.js 16.3.3 and 15.5.24?
These releases are primarily security patches, not a new major version. They address two Critical flaws disclosed in the official August Next.js advisory:
| Vulnerability | Main condition | Affected versions | Fix |
|---|---|---|---|
| CVE-2026-75604 / GHSA-p293-qw3h-jr36 Windows server RCE, CVSS 9.0 |
Pages Router or App Router without Cache Components, running on a Windows filesystem. | ≥13.4 and <15.5.24; ≥16.0 and <16.3.3 | 15.5.24 or 16.3.3 |
| GHSA-2xp9-vwfh-vxw4 RCE while optimizing AVIF, CVSS 9.5 |
AVIF files processed by the Image Optimization API through Sharp and the underlying libheif library. | Next.js 10.0.0 through releases before 15.5.24; version 16 before 16.3.3 | 15.5.24 or 16.3.3; the patch temporarily disables AVIF optimization |
First RCE: Next.js applications hosted on Windows
The first vulnerability is a path traversal issue that can result in remote code execution when the application is served from a machine using a Windows filesystem. It affects both the Pages Router and App Router when Cache Components are not in use. Authentication and user interaction are not required.
The official advisory is explicit: there is no known workaround for an affected Windows-hosted application. A WAF, CDN, or reverse proxy does not replace the patch. If process.platform returns win32 and your version falls within the vulnerable range, upgrade immediately.
Second RCE: AVIF image optimization
Next.js uses Sharp to transform images. Sharp relies on libheif to process AVIF. A flaw in that chain can lead to code execution when the optimizer receives a specially crafted AVIF file. The risk matters most when an application optimizes remote images or third-party uploads.
In the patched releases, AVIF optimization is disabled while the dependency fix propagates. You may therefore see a request that previously negotiated AVIF use another format. That difference is an intentional security measure, not necessarily a configuration error.
Is your application exposed? Checklist
- Confirm the installed version: do not rely only on the range declared in
package.json. - Check the operating system: the first RCE focuses on Windows hosts.
- Review AVIF use: look for
image/avifinimages.formatsand determine whether you accept remote images or user uploads. - Inventory every deployment: an updated staging environment does not mean production, workers, and replicas are patched.
npm ls next sharp
node -p "require('next/package.json').version"
node -p "process.platform"The win32 result identifies Node.js on Windows. Linux normally returns linux. Even on Linux, the AVIF optimizer issue can still be relevant.
How to upgrade to Next.js 16.3.3 or 15.5.24
1. Create a branch and preserve the previous state
Back up the code, lockfile, environment variables, and persistent data. On a VPS, a pre-deployment snapshot makes recovery easier. A rollback should take you to a working artifact that already includes the patch; avoid reverting to a vulnerable release.
2. Install the exact release for your branch
To minimize simultaneous changes, start with a targeted update of the next package:
# Active LTS: Next.js 16
npm install [email protected]
# Maintenance LTS: Next.js 15
npm install [email protected]With other package managers:
pnpm add [email protected]
yarn add [email protected]
bun add [email protected]Deploy Next.js with real server control
Run Node.js and Next.js on a VPS with root access, dedicated resources, snapshots, and the freedom to apply patches when production needs them.
Choose one command and one branch. If you are moving from Next.js 13, 14, or an older 15 release, this is no longer a simple patch: follow the official Next.js 16 upgrade guide and run the official codemod in a separate branch.
3. Rebuild and test
npm run build
npm test
npm ls next
node -p "require('next/package.json').version"If the project does not define npm test, run the actual test command for your repository. Pay particular attention to image routes, uploads, Server Actions, authentication, caching, Middleware or Proxy, and dynamically rendered pages.
4. Deploy every replica
A local upgrade does not protect the server. Produce a new artifact and restart every instance. With Docker, avoid reusing an old node_modules layer:
docker build --pull --no-cache -t my-app:next-16.3.3 .
docker compose up -d --force-recreateWith PM2, build before reloading:
npm run build
pm2 reload ecosystem.config.js --update-env5. Verify production
- Confirm 16.3.3 or 15.5.24 inside the running container or process.
- Verify that the lockfile changed and was committed.
- Watch 4xx/5xx errors, latency, memory, and restarts during rollout.
- Test JPEG, PNG, WebP, and AVIF images; document the temporary AVIF behavior.
- Remove any replica still running an older image from the load balancer.
What if you are coming from Next.js 16.2 or 15.5?
If you are already on 16.x, the 16.3 line also contains the broader improvements announced for that release: Instant Navigations, faster builds and rendering, and up to 90% less development memory in scenarios measured by the Next.js team. Keep the distinction clear: 16.3.3 is the security patch; those features arrived with 16.3.
If compatibility requires you to remain on 15.5, version 15.5.24 delivers the Critical fixes without forcing immediate adoption of Next.js 16's major changes. It can be the lower-risk operational path while you prepare and test a migration.
Mistakes to avoid
- Updating only package.json: production may still use a version pinned in the lockfile or an old Docker image.
- Relying only on npm audit: an advisory database can lag behind a recent publication.
- Disabling AVIF and postponing forever: the official recommendation remains to install a patched release.
- Rolling back to the vulnerable package: if you hit a regression, use 15.5.24 as the maintenance branch or fix the rollout without losing the patch.
- Forgetting secondary Windows servers: internal panels, staging, and scheduled jobs also count.
Frequently asked questions
Is Next.js 16.3.2 safe?
Not against these two vulnerabilities. The patched release on version 16 is 16.3.3.
Can I stay on Next.js 15?
Yes. Next.js 15.5.24 is the patched Maintenance LTS release for this security update.
Is Linux affected?
The CVE-2026-75604 RCE is specific to Windows filesystem hosts. The AVIF flaw should not be treated as Windows-only; review any deployment that uses image optimization.
Must I upgrade React at the same time?
Not necessarily for this targeted patch. Upgrade next, respect the compatible dependencies in your project, and review your package manager output. A major migration may require additional changes.
Does a CDN remove the risk?
No. It can restrict some traffic, but it does not correct the vulnerable code or guarantee that a malicious file never reaches the optimizer.
Conclusion
Next.js 16.3.3 and 15.5.24 are priority updates because they close two separate paths to remote code execution. Identify versions, operating systems, and AVIF usage; update the appropriate branch; rebuild every artifact; and verify the live production version. If you already applied the July 2026 Next.js security update, this August patch is still required.
