---
title: "Next.js security release (August 2026): what to know"
description: "Two critical Next.js RCE advisories: one Windows-only, one in image optimization. What this means for Netlify sites. Upgrade to 15.5.24 or 16.3.3."
source: "https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/"
last_updated: "2026-08-25T22:53:51.000Z"
---
The Next.js team has disclosed [two critical severity vulnerabilities](https://github.com/vercel/next.js/security), both of which can lead to unauthenticated remote code execution. Both are patched in **15.5.24** and **16.3.3**. **Netlify-hosted sites are not affected by the Windows issue, and do not run the Next.js code path affected by the image issue.** We still recommend upgrading. Here’s what Netlify customers need to know.

## Vulnerabilities

Vulnerability

Severity

Affected versions

CVE-2026-75604 / [GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36) — Unauthenticated remote code execution on Windows-hosted servers

Critical

≥13.4.0 <15.5.24, ≥16.0.0 <16.3.3

[GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4) — Unauthenticated remote code execution in Image Optimization API when AVIF files are used

Critical

≥10.0.0 <15.5.24, ≥16.0.0 <16.3.3

## Impact on Netlify

### Unauthenticated remote code execution on Windows-hosted servers

CVE-2026-75604 / [GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36): Netlify sites are **not affected**. The issue affects Windows-hosted deployments only, and [Netlify Functions](https://docs.netlify.com/build/functions/overview/) and [Edge Functions](https://docs.netlify.com/build/edge-functions/overview/) run on Linux.

### Unauthenticated remote code execution in Image Optimization API when AVIF files are used

[GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4): Netlify sites **do not run the affected Next.js code path**. Requests to `/_next/image` are rewritten to [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/) at our edge, so the Next.js Image Optimization API is never invoked.

## What should I do?

Netlify sites are not affected by the Windows issue and do not run the affected image code path, but we always strongly recommend upgrading as soon as possible to patched releases:

-   `next` 15.5.24 or later, or 16.3.3 or later, then redeploy.

## Resources

-   [Next.js August 2026 security release](https://nextjs.org/blog/august-2026-security-release)
-   [Next.js security advisories](https://github.com/vercel/next.js/security)