Next.js moved its August security release forward to Aug 25, shipping 16.3.3 and 15.5.24 to close two critical RCEs, a Windows-only path traversal and a crafted-AVIF image optimization exploit.
Next.js moved its August security release up to Aug 25, shipping 16.3.3 and 15.5.24 with patches for two critical RCEs, not the single vulnerability originally announced for Aug 26.
The first, CVE-2026-75604, is an unauthenticated Windows-only path traversal that leads to remote code execution. It affects the Pages Router and the App Router in apps that don't use Cache Components. The second, GHSA-2xp9-vwfh-vxw4, is an RCE through crafted AVIF images in the Image Optimization API, which runs through the libheif/sharp dependency. The patch mitigates it by disabling AVIF optimization outright.
One of the two already has a public proof of concept, so treat these as actively exploited. If you run self-hosted Next.js on Windows or with AVIF image optimization enabled, you are squarely in the blast radius. Upgrade with npm install next@16.3.3 on the 16.x line or next@15.5.24 on 15.x.
This is the most severe installment of the monthly security program so far, and it did not wait for the scheduled date. Pull the upgrade into this week's work, not the backlog, and check which routers and features your app actually exercises before you assume you're clear.
The Aug 31 patch brings back the AVIF output that the critical Aug 25 security release disabled, but only when your installed sharp resolves to 0.35.4 or newer.
3 sources
Cross-user cache poisoning in SSG and ISR is the item to act on, and the 15.x line backports only some of the set.
2 sources
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources