Security Update: Two critical Next.js vulnerabilities
August 25, 2026
The Next.js team has disclosed two critical severity vulnerabilities, both of which can lead to unauthenticated remote code execution. Both are patched in 15.5.24 and 16.3.3. Netlify-hosted sites are not affected by the Windows issue, and do not run the Next.js code path affected by the image issue. We still recommend upgrading. Here’s what Netlify customers need to know.
Vulnerabilities
| Vulnerability | Severity | Affected versions |
|---|---|---|
| CVE-2026-75604 / GHSA-p293-qw3h-jr36 — Unauthenticated remote code execution on Windows-hosted servers | Critical | ≥13.4.0 <15.5.24, ≥16.0.0 <16.3.3 |
| GHSA-2xp9-vwfh-vxw4 — Unauthenticated remote code execution in Image Optimization API when AVIF files are used | Critical | ≥10.0.0 <15.5.24, ≥16.0.0 <16.3.3 |
Impact on Netlify
Unauthenticated remote code execution on Windows-hosted servers
CVE-2026-75604 / GHSA-p293-qw3h-jr36: Netlify sites are not affected. The issue affects Windows-hosted deployments only, and Netlify Functions and Edge Functions run on Linux.
Unauthenticated remote code execution in Image Optimization API when AVIF files are used
GHSA-2xp9-vwfh-vxw4: Netlify sites do not run the affected Next.js code path. Requests to /_next/image are rewritten to Netlify Image CDN at our edge, so the Next.js Image Optimization API is never invoked.
What should I do?
Netlify sites are not affected by the Windows issue and do not run the affected image code path, but we always strongly recommend upgrading as soon as possible to patched releases:
next15.5.24 or later, or 16.3.3 or later, then redeploy.