Next.js 16.3.3 / 15.5.24 Security Patch: CVE-2026-75604 and AVIF RCE Checks
Two Critical Next.js security issues were patched this week. If you maintain a Next.js application, the first job is not to read ten summaries of the vulnerabilities. It is to answer four practical questions: Which Next.js version is actually deployed? Does the Windows-hosted RCE apply to this deployment? Can this application optimize attacker-controlled AVIF images? Has the patched version…
Two major Next.js security vulnerabilities were addressed this week. To ensure your Next.js application is protected, follow these four practical steps: determine which version is currently deployed, assess if the Windows-hosted remote code execution vulnerability applies, verify the AVIF remote code execution checks, and confirm the patched version is in production.
The August 2026 security release includes Next.js 15.5.24 for 15.x applications and 16.3.3 for 16.x applications, both addressing critical issues. For Windows-hosted applications, upgrade is the only solution for CVE-2026-75604. AVIF optimization vulnerabilities affect versions 10.0.0 through 16.3.3, and the patched versions remain 15.5.24 and 16.3.3.
To check your deployment, run npm ls next or use Node commands to view the installed version. Upgrade using npm install next@15.5.24 or next@16.3.3, based on your application's version. Confirm the upgrade by checking the version again in package.json and locking it in the lockfile. Test your application thoroughly after the upgrade, focusing on critical routes and image optimization flows. Finally, verify the deployed version to ensure the security patch reaches production.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
