Copy link to heading Summary

Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Next.js applications hosted on Vercel are protected and require no customer action.

Copy link to heading Next.js August 2026 vulnerabilities

Next.js disclosed the following critical vulnerabilities:

GHSA-2xp9-vwfh-vxw4 originates in the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input.

CVE-2026-75604 ( GHSA-p293-qw3h-jr36 ) can lead to unauthenticated remote code execution on Windows-hosted Next.js servers in applications using the Pages Router and App Router without Cache Components.

After the AVIF vulnerability was identified, Vercel applied protections to its managed Image Optimization service.

Copy link to heading Impact on Vercel deployments

Applications hosted on Vercel are protected.…