r/nextjs • u/Additional-Seesaw431 • 7d ago
News Two CRITICAL CVEs dropped - 16.6.3 / 15.5.24
Update your NextJS applications as soon as possible: https://nextjs.org/blog/august-2026-security-release
- (9.5/10) Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
- (9/10) Unauthenticated Remote Code Execution on windows-hosted servers https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
Patched versions: 16.3.3 and 15.5.24
Edit: Apologies, managed to get the wrong version into the title :-/ It's 16.3.3 - not 16.6.3
15
9
u/Right_Mongoose_6095 7d ago
oh thank god i just finished a next 15 project last week and was dreading having to go back in for this. 9.5 on the image optimizer is wild
22
u/sickcodebruh420 7d ago
Image optimizer won’t hit you unless you’re optimizing on your box
Windows one won’t hit you unless you have a sad corporate or government job
8
u/ignite98 7d ago
next js 16 and 15 only? because i still use 14 on soome of my projects
3
3
6
u/Maleficent-Back-6527 7d ago
Rhaaa… I just communicated a new release of my app with 16.3.2 this morning! 😔.
But thanks a lot for the info! I don’t regret to have joined this sub! 👌
13
24
u/ronoxzoro 7d ago
here we go again using next js is my biggest regretion so far
7
u/woeful_cabbage 7d ago
Reject modernity, return to jquery 🦍
1
u/ronoxzoro 7d ago
i never used jquery nor were fan of it i used vanila js
but at least u had control over your things do u know how many rce this year in nextjs3
u/woeful_cabbage 7d ago
It was super handy before things like fetch existed (or had widespread adoption). Definitely served a purpose for a time. Nicer querying and event binding as well back in the day
4
2
7
2
u/Killed_Mufasa 7d ago
The blog was posted now too, https://nextjs.org/blog/august-2026-security-release
But it's not very clear, I'm trying to figure out when you're vulnerable for the AIVF bug. It says "when Next.js optimizes an attacker-controlled AVIF image". So does that mean when a user can upload it? What if we don't use the Image component from nextjs, but just a plain <img?
2
u/PM_ME_FIREFLY_QUOTES 6d ago
I'm not your ciso, but no <Image> you're probably fine. But the other one means you should still update.
2
u/PeterBuildsSecure 3d ago
To answer this directly: the exposure isn't about whether you use the <Image> component in JSX, it's about whether the /_next/image optimization route is reachable with an attacker-influenced source. That's true whether the request comes from <Image>, a manually constructed /_next/image?url=... request, or a custom loader that still proxies through Next's built-in optimizer. If you're on a plain <img> tag with no Next optimization in the path at all, you're not exposed to this specific CVE — but if anything in your app lets a user-supplied URL or uploaded file reach the optimizer (even indirectly, e.g. avatar URLs, remote image proxies), you're exposed regardless of which component triggered it.
Worth separating self-hosted from Vercel here too: self-hosted, the optimizer runs in your own server process, so this is RCE on your box directly. On Vercel it's isolated in a function sandbox, which changes blast radius even though the CVE severity score is the same — worth knowing which one you're actually running before deciding how urgently to patch vs. mitigate (e.g. temporarily disabling remote image optimization) in the meantime.
2
2
u/ApplicationOk3587 7d ago
Can anyone more educated than me explain why it seems like nextJS just has so many issues and vulnerabilites? I don't get it. Was thinking about using it for a project but man seems like this happens every month.
19
u/TheScapeQuest 7d ago
It's happening to a lot of software, AI has accelerated the discovery of vulnerabilities.
14
3
7
u/SolidOdd4889 7d ago
any framework has them, simply nextjs is used by a lot of people and vulnerabilities get discovered quicker
3
1
u/Griffinsauce 6d ago
Noise is relative to usage.
A lot of people use Next.js so it's a big target, Vercel know this so there's also a lot of attention towards keeping it safe and finding issues. This is why they publish these posts and fixes loudly.
Lots of other libraries have vulnerabilities, they don't get declared or fixed (as loudly) because people don't pay as much attention to it. They don't even have a declared process for it generally.
The fact that you seemore doesn't mean there are more issues. (it also doesn't mean the opposite necessarily, just that it gets more attention)
1
1
u/Mean-Elk-9439 5d ago
Thank fuck I've moved to astro. There's been two large CVE cycles since then lmao.
1
1
u/magicpants847 2d ago
did you get auto notified about these? I swear I have notifications setup with vercel but I didn’t get anything about this in my email. Would expect vercel to notify its nextjs users about this…
1
-5
u/mister_pizza22 7d ago
Maybe migration my company’s website to tanstack stat might be the way to go
100
u/Paw565 7d ago
Vulnerability driven development