Vercel applications protected from Next.js August 2026 security vulnerabilities
Two critical vulnerabilities affecting Next.js image optimization and Windows-hosted servers were disclosed in August 2026. Vercel-hosted applications are automatically protected and require no action, while self-hosted Next.js applications must upgrade to patched versions.
Summary
Impact on Vercel deployments
Resolution for self-hosted applications
Credit
References
Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Next.js applications hosted on Vercel are protected and require no customer action.
Next.js disclosed the following critical vulnerabilities:
After the AVIF vulnerability was identified, Vercel applied protections to its managed Image Optimization service.
Applications hosted on Vercel are protected. No upgrades, configuration changes, or redeploys are required.
Self-hosted Next.js applications should upgrade to the appropriate patched version.
For applications running Next.js 15.x or earlier:
For applications running Next.js 16.x:
In the patched releases, AVIF images are not resized or optimized. They are served as-is until a fixed libheif version is available. There is no workaround for the Windows vulnerability; affected servers should upgrade immediately.
Thanks to the Hacktron team for responsibly disclosing the AVIF vulnerability, and to and for responsibly disclosing the Windows vulnerability.evolutionstormB0RI
Next.js August 2026 vulnerabilities
originates in the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input.GHSA-2xp9-vwfh-vxw4
() can lead to unauthenticated remote code execution on Windows-hosted Next.js servers in applications using the Pages Router and App Router without Cache Components.CVE-2026-75604GHSA-p293-qw3h-jr36
Once the AVIF vulnerability was identified, Vercel disabled AVIF optimization across its managed Image Optimization service. AVIF inputs are served as-is and do not pass through the affected processing path.
The second vulnerability only affects servers using a Windows filesystem. Vercel's Next.js runtime uses Linux and is not affected.
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
Gemini 4 Argon now available on AI Gateway
Google's Gemini 4 Argon model is now available through Vercel's AI Gateway with support for coding, agentic work, and complex reasoning tasks. The model features a 1M token context window, multimodal input capabilities (text, image, PDF, video), tool calling, and configurable thinking levels for enhanced performance.
MAI-Image-2.6 and MAI-Image-2.6-Flash now available on AI Gateway
Microsoft's MAI-Image-2.6 and MAI-Image-2.6-Flash models are now available on AI Gateway, enabling image generation and editing through a single API key without requiring separate provider accounts. Both models support photorealistic imagery, text rendering, targeted edits, and up to five reference images with output sizes up to 1536×1536.
Repository checkout and Git LFS downloads are now faster
Repository checkout and Git LFS downloads are now faster on Vercel, reducing build preparation time. Average checkout time improved by 20%, with LFS-enabled projects seeing a 54% improvement and saving approximately 13 seconds per deployment.