--- title: The Critical Next.js Security Patch You Shouldn't Skip description: The August 2026 Next.js security patch fixes two critical RCE bugs. Here is what 16.3.3 and 15.5.24 close, and how to audit your own app for the same class. canonical: https://lukeocodes.dev/nextjs-security-patch type: article locale: en_GB published: 2026-08-25T00:00:00.000Z modified: 2026-08-25T00:00:00.000Z authors: - Luke Oliff section: Security tags: - Security - JavaScript - next.js - rce - cve - image optimization feed: https://lukeocodes.dev/rss.xml search: https://lukeocodes.dev/search.json?q={query} schema: - "@context": https://schema.org "@graph": - "@type": WebSite "@id": https://lukeocodes.dev/#website url: https://lukeocodes.dev name: Luke Oliff alternateName: lukeocodes inLanguage: en publisher: "@id": https://lukeocodes.dev/authors/luke#person description: Personal blog and writing by Luke Oliff — developer relations, voice AI, developer experience. potentialAction: - "@type": SearchAction target: "@type": EntryPoint urlTemplate: https://lukeocodes.dev/blog/search?q={search_term_string} query-input: required name=search_term_string - "@type": Person "@id": https://lukeocodes.dev/authors/luke#person name: Luke Oliff url: https://lukeocodes.dev/authors/luke description: Engineer and developer relations leader. Writing about developer relations, AI, and the voice industry, from the UK. mainEntityOfPage: https://lukeocodes.dev/authors/luke givenName: Luke familyName: Oliff image: https://lukeocodes.dev/authors/luke.jpg jobTitle: Engineer and developer relations leader sameAs: - https://www.linkedin.com/in/lukeocodes - https://github.com/lukeocodes - https://bsky.app/profile/lukeocodes.dev - https://x.com/lukeocodes - https://hashnode.com/@lukeocodes - https://dev.to/lukeocodes knowsAbout: - Developer Relations - Developer Experience - Voice AI - Text-to-Speech - Answer Engine Optimisation - Search Engine Optimisation - Open Source - Developer Tooling - API Design - Speech-to-Text - Voice Agents - Community Building knowsLanguage: - English nationality: British alumniOf: - "@type": Organization name: The Open University - "@context": https://schema.org "@graph": - "@type": Person "@id": https://lukeocodes.dev/authors/luke#person name: Luke Oliff url: https://lukeocodes.dev/authors/luke description: Engineer and developer relations leader. Writing about developer relations, AI, and the voice industry, from the UK. mainEntityOfPage: https://lukeocodes.dev/authors/luke givenName: Luke familyName: Oliff image: https://lukeocodes.dev/authors/luke.jpg jobTitle: Engineer and developer relations leader sameAs: - https://www.linkedin.com/in/lukeocodes - https://github.com/lukeocodes - https://bsky.app/profile/lukeocodes.dev - https://x.com/lukeocodes - https://hashnode.com/@lukeocodes - https://dev.to/lukeocodes knowsAbout: - Developer Relations - Developer Experience - Voice AI - Text-to-Speech - Answer Engine Optimisation - Search Engine Optimisation - Open Source - Developer Tooling - API Design - Speech-to-Text - Voice Agents - Community Building knowsLanguage: - English nationality: British alumniOf: - "@type": Organization name: The Open University - "@type": BlogPosting "@id": https://lukeocodes.dev/nextjs-security-patch#article headline: The Critical Next.js Security Patch You Shouldn't Skip alternativeHeadline: The Critical Next.js Security Patch You Shouldn't Skip description: The August 2026 Next.js security patch fixes two critical RCE bugs. Here is what 16.3.3 and 15.5.24 close, and how to audit your own app for the same class. datePublished: 2026-08-25T00:00:00.000Z dateModified: 2026-08-25T00:00:00.000Z url: https://lukeocodes.dev/nextjs-security-patch mainEntityOfPage: https://lukeocodes.dev/nextjs-security-patch inLanguage: en author: - "@id": https://lukeocodes.dev/authors/luke#person isPartOf: "@id": https://lukeocodes.dev/#website keywords: Security, JavaScript, next.js, rce, cve, image optimization articleSection: Security about: - "@type": SoftwareApplication name: Next.js - "@type": Organization name: Vercel abstract: "On 25 August 2026 Next.js shipped an emergency cross-LTS release, 16.3.3 and 15.5.24, fixing two critical unauthenticated remote code execution bugs: an AVIF image-optimization flaw via libheif, and a Windows path traversal. Patch, then audit your own image and hosting surface." speakable: "@type": SpeakableSpecification cssSelector: - .post-tldr - h1 image: https://lukeocodes.dev/og.png?h=The+Critical+Next.js+Security+Patch+You+Shouldn%27t+Skip&d=The+August+2026+Next.js+security+patch+fixes+two+critical+RCE+bugs.+Here+is+what+16.3.3+and+15.5.24+close%2C+and+how+to+audit+your+own+app+for+the+same+class.&e=Writing wordCount: 509 timeRequired: PT3M publisher: "@id": https://lukeocodes.dev/authors/luke#person - "@type": BreadcrumbList itemListElement: - "@type": ListItem position: 1 name: Home item: https://lukeocodes.dev - "@type": ListItem position: 2 name: Writing item: https://lukeocodes.dev/blog - "@type": ListItem position: 3 name: The Critical Next.js Security Patch You Shouldn't Skip item: https://lukeocodes.dev/nextjs-security-patch - "@type": FAQPage "@id": https://lukeocodes.dev/nextjs-security-patch#faq mainEntity: - "@type": Question name: Which Next.js versions fix the August 2026 vulnerabilities? acceptedAnswer: "@type": Answer text: Next.js 16.3.3 on the Active LTS line and 15.5.24 on Maintenance LTS. Run npm install next@16.3.3 or next@15.5.24 depending on your line. Both close the same two critical bugs. - "@type": Question name: Am I affected if I don't use AVIF or Windows? acceptedAnswer: "@type": Answer text: The AVIF bug triggers when the Image Optimization API processes an attacker-controlled AVIF, even if you never chose AVIF yourself. The path traversal only hits Windows-hosted servers. Linux and macOS are not affected by that one. --- [Luke Oliff.](/) - [Blog](/blog) - [CV](/cv) - [Uses](/uses) - [User manual](/user-manual) - [Living with ADHD](/living-and-working-with-adhd) - [RSS](/rss.xml) [Luke Oliff · Writing](/blog) # The Critical Next.js Security Patch You Shouldn't Skip Aug 2026 · [Security](/blog/category/security) · 3 min read · [Luke Oliff](/authors/luke) **TL;DR:** On 25 August 2026 Next.js shipped an emergency cross-LTS release, 16.3.3 and 15.5.24, fixing two critical unauthenticated remote code execution bugs: an AVIF image-optimization flaw via libheif, and a Windows path traversal. Patch, then audit your own image and hosting surface. This Next.js security patch is not a routine bump. On 25 August 2026 the team shipped an emergency cross-LTS release, [16.3.3 and 15.5.24](https://nextjs.org/blog/august-2026-security-release), after finding a second critical bug in an upstream dependency and pulling the date forward. Both are unauthenticated remote code execution. If you self-host, patch today. ## What the patch actually closes Two critical-severity issues, both leading to unauthenticated RCE. The first is in the Image Optimization API. A flaw in the `libheif` library that `sharp` uses can lead to remote code execution when Next.js optimizes an attacker-controlled AVIF image ([GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)). The patched releases disable AVIF optimization outright until the upstream fix lands. You did not have to choose AVIF for this to matter. If your optimizer will accept and decode an AVIF someone else supplies, you are in scope. The second is a Windows-specific path traversal ([CVE-2026-75604](https://www.cve.org/CVERecord?id=CVE-2026-75604)). Apps using both the Pages Router and the App Router without Cache Components can hit RCE when the server runs on a Windows filesystem. Linux and macOS are not affected, and Vercel notes there is no known workaround for affected Windows hosts other than upgrading. ## How to audit your own app for the same class Patching is step one. The more useful exercise is checking whether your app hands untrusted bytes to a native decoder, because that is the bug class here. Start with your image surface. Anything that pipes remote or user-supplied images through the optimizer is a candidate: ```bash # Where does next/image point at external hosts? grep -rn "remotePatterns\|domains" next.config.* ``` If `remotePatterns` is wide open, the optimizer will fetch and decode whatever a URL resolves to. Narrow it to hosts you actually serve. Treat the optimizer as code that runs a C image library on input you do not control, because that is exactly what it is. Then check your hosting. If you deploy to Windows, the second bug is live until you upgrade, full stop. Confirm the runtime: ```bash node -e "console.log(process.platform)" # 'win32' means audit now ``` Middleware will not save you from either of these. People reach for middleware as a security boundary, but the image optimizer and the static route resolution both run outside the request paths most middleware guards. Middleware is good for auth and redirects. It is the wrong tool for blocking a decoder exploit, and treating it as a shield here gives false comfort. ## The pattern worth internalising Both bugs come from the same shape: a framework feature quietly shells out to native code that parses a hostile file format. That is not unique to Next.js. Any framework that optimizes images, parses uploads, or generates thumbnails is one bad upstream `libheif`, `libwebp`, or `ImageMagick` away from the same headline. So the durable takeaway is not "patch Next.js", though you should. It is: know every place your app feeds untrusted input to a native library, keep those libraries on a fast patch cadence, and stop pretending middleware is a wall. Upgrade to 16.3.3 or 15.5.24, then go find the next decoder you forgot you were running. [← Newer: Node 26.8 Put Syntax Highlighting in the REPL](/node-repl-highlighting) [All posts](/blog) → ## Search this site `GET https://lukeocodes.dev/search.json?q=` returns matching posts as JSON, each with its page URL and its markdown URL. Add `&limit=<1-50>` for more than 10. How it works: [/blog/search](https://lukeocodes.dev/blog/search.md). ```sh curl "https://lukeocodes.dev/search.json?q=developer+relations" ``` --- © 2026 Luke Oliff. Posts live at the root of this site. - [GitHub](https://github.com/lukeocodes) - [LinkedIn](https://www.linkedin.com/in/lukeocodes) - [X](https://x.com/lukeocodes) - [Bluesky](https://bsky.app/profile/lukeocodes.dev) - [Email](mailto:luke@lukeoliff.com) - [RSS](/rss.xml) ## Cookies This site sets one analytics cookie, from Google Analytics, and only in a browser that accepts the cookie banner. A client that does not run scripts sets no cookies, so there is nothing to accept or decline here. [Cookie policy](/cookies)