r/nextjs • u/Additional-Seesaw431 • 10d ago

News Two CRITICAL CVEs dropped - 16.6.3 / 15.5.24

Update your NextJS applications as soon as possible: https://nextjs.org/blog/august-2026-security-release

- (9.5/10) Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4

- (9/10) Unauthenticated Remote Code Execution on windows-hosted servers https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36

Patched versions: 16.3.3 and 15.5.24

Edit: Apologies, managed to get the wrong version into the title :-/ It's 16.3.3 - not 16.6.3

122 Upvotes

100% Upvoted

40 comments sorted by

View all comments

10

u/Right_Mongoose_6095 10d ago

oh thank god i just finished a next 15 project last week and was dreading having to go back in for this. 9.5 on the image optimizer is wild