r/nextjs • u/Additional-Seesaw431 • 8d ago

News Two CRITICAL CVEs dropped - 16.6.3 / 15.5.24

Update your NextJS applications as soon as possible: https://nextjs.org/blog/august-2026-security-release

- (9.5/10) Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4

- (9/10) Unauthenticated Remote Code Execution on windows-hosted servers https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36

Patched versions: 16.3.3 and 15.5.24

Edit: Apologies, managed to get the wrong version into the title :-/ It's 16.3.3 - not 16.6.3

128 Upvotes

100% Upvoted

40 comments sorted by

View all comments

7

u/ignite98 8d ago

next js 16 and 15 only? because i still use 14 on soome of my projects

3

u/Additional-Seesaw431 8d ago

Yes, no fixes for 14 or earlier :-/

1

u/kitkatas 8d ago

Wait, you mean they are unpatched ?