Vercel applications are protected from Next.js August 2026 security vulnerabilities
Vercel states its hosted Next.js applications are protected from two August 2026 security flaws without customer action, while self-hosted users must upgrade.
Two vulnerabilities disclosed in the August 2026 Next.js Security Release could allow unauthenticated remote code execution. The first, GHSA-2xp9-vwfh-vxw4, stems from the upstream libheif dependency and affects Image Optimization when processing crafted AVIF files. Vercel reports its managed Image Optimization service has been updated to block this path; AVIF inputs are now served unchanged, requiring no customer changes.
The second issue, CVE-2026-75604 (GHSA-p293-qw3h-jr36), impacts Windows-hosted Next.js servers using the Pages or App Router without Cache Components. Vercel notes its Next.js runtime runs on Linux and is unaffected, but self-hosted Windows deployments must upgrade to patched versions immediately.
Vercel disabled AVIF optimization across its managed Image Optimization service after identifying the AVIF vulnerability. Affected applications hosted on Vercel now receive AVIF files without processing, eliminating the vulnerable code path without requiring upgrades or redeploys from customers.
Self-hosted Next.js users should upgrade to the patched releases where AVIF images are served as-is until a fixed libheif version is available. There is no workaround for the Windows filesystem flaw; affected servers must upgrade promptly. Credits were given to Hacktron, evolutionstorm, and B0RI for responsible disclosures.