Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)

What to do

1. Run npm ls next sharp satori in every Next.js service and note which ones are self-hosted.
2. Upgrade: npm install next@15.5.28 or next@16.4.1 (minimums for these bugs: 15.5.24, 16.3.3, and 16.3.6 for next/og), then rebuild and redeploy.
3. On Windows hosts, treat any unpatched, internet-facing server as possibly exposed: rebuild, and rotate NEXT_SERVER_ACTIONS_ENCRYPTION_KEY if you pin it.
4. If you cannot upgrade a 16.2+ app yet, stop passing request data into SVG content, attributes or styles rendered by the Node.js ImageResponse.
5. Update any system libheif on image-processing hosts to 1.23.2 or later.

How to check if you are affected or compromised

• npm ls next sharp satori, and compare against 15.5.24, 16.3.3, 16.3.6, sharp 0.35.4 and Satori 0.33.5.
• On Windows-hosted servers, search access logs for encoded backslashes (%5C) in route segments, and check for reads of build files outside the cache directory.
• Review /_next/image logs for AVIF sources from unexpected hosts or uploads, and for crashed or restarted image workers.
• Hunt for unexpected child processes or outbound connections from the Next.js server process.

What happened#

On August 25, 2026, Vercel shipped the Next.js August security release, versions 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS). It fixes two critical bugs that allow unauthenticated remote code execution. The release had been announced for August 26. It was moved forward a day after a second critical issue turned up in an upstream dependency. A third critical RCE, in next/og, followed on September 22 in 16.3.6. GitHub's global advisory database listed the August pair on September 8 and the next/og one on September 30.

• CVE-2026-75604 / GHSA-p293-qw3h-jr36 (CVSS 3.1 9.0). The CVE record says Next.js on Windows does not consistently escape backslashes in route segments before it builds incremental-cache paths. A request with encoded Windows path separators can escape the cache root and read private build data, including the server-reference-manifest encryption key, and that leak can lead to RCE. It affects 13.4.0 up to 15.5.24 and 16.x before 16.3.3, in apps using the Pages Router or the App Router without Cache Components. Linux and macOS are not affected, and there is no workaround.
• GHSA-2xp9-vwfh-vxw4 (CVSS 4.0 9.5, no Next.js CVE). Optimizing an attacker-controlled AVIF image can lead to RCE through libheif, which sharp uses. The root bug is CVE-2026-84383, a heap out-of-bounds write in libheif 1.22.0 to 1.23.1, fixed in 1.23.2. Its advisory says, "We were able to get RCE using this on multiple applications." Next.js 15.5.24 and 16.3.3 simply disabled AVIF optimization. PR #97931, merged August 26, turned it back on and required sharp ^0.35.4, which bundles libheif 1.23.2.
• GHSA-vcvr-r3jv-pc5j (CVSS 4.0 9.5). The Node.js ImageResponse in next/og inherits CVE-2026-94545, improper escaping in Satori's SVG output (fixed in Satori 0.33.5). Apps are exposed only if they pass attacker-controlled values into SVG content, attributes or styles. It affects 16.2.0 up to 16.3.6 and was fixed in v16.3.6.

Who is affected#

Self-hosted Next.js is the main concern: next start, standalone output, Docker images and Windows servers. Netlify says its sites are not affected by either August bug. Its functions run on Linux, and it rewrites /_next/image to its own image CDN. Vercel's posts don't address Vercel-hosted deployments. Next.js 15.x is outside the next/og range.

Do you really need to act?#

Each bug has preconditions, which is why every vector includes "attack requirements: present" or "high complexity". The Windows bug needs a Windows host and nothing else from the attacker. The AVIF bug needs the optimizer to process an AVIF the attacker controls, through an allowed remote host or user uploads served as local images. The next/og bug needs your code to put untrusted input into SVG. No exploitation was reported for any of them as of October 21, 2026, and none is in CISA KEV. But the fixes are two months old, and the October 14 release (16.4.1 / 15.5.28) fixes two more critical RCEs. A service still below 15.5.24 or 16.3.3 is now behind on four critical fixes.

What to do now#

1. Find versions: npm ls next sharp satori in each app, or pnpm why next.
2. Upgrade to the current line: npm install next@16.4.1 or npm install next@15.5.28, then rebuild and redeploy the image. Bumping the version without redeploying fixes nothing.
3. For Windows hosts that were exposed while unpatched, rebuild and redeploy. The Next.js docs say a new Server Actions key is generated on every build unless NEXT_SERVER_ACTIONS_ENCRYPTION_KEY pins it, so rotate that variable if you set it (openssl rand -base64 32).
4. Until a 16.2+ app is upgraded, keep request data out of SVG markup rendered by the Node.js ImageResponse, or render with the Edge runtime.
5. Update any system libheif on image-processing hosts to 1.23.2 or later.

How to tell if you were hit#

On Windows hosts, search access logs for encoded backslashes (%5C) in route segments. Also check file-access auditing for reads of .next build files outside the cache directory. For the AVIF path, review /_next/image requests for AVIF sources from unexpected hosts or recent uploads, and look for crashed or restarted image workers. In all cases, investigate unexpected child processes, shells or outbound connections spawned by the Node.js server, and rotate secrets the process could read if you find any.

Timeline#

• Aug 25, 2026 — Next.js moves the release forward a day. 16.3.3 and 15.5.24 ship around 16:17 UTC, and libheif publishes 1.23.2's advisory.
• Aug 26, 2026 — sharp 0.35.4 ships with libheif 1.23.2, and Next.js merges the change that re-enables AVIF.
• Sep 1, 2026 — CVE-2026-75604 is published.
• Sep 8, 2026 — GitHub's advisory database lists the two August advisories.
• Sep 22, 2026 — Next.js 16.3.6 fixes the next/og RCE.
• Sep 30, 2026 — CVE-2026-94545 and the global next/og advisory are published.

Vulnerability records

• CVE-2026-75604 · Next.js is a React framework for building full-stack web applications.
• CVE-2026-84383 · libheif is a HEIF and AVIF file format decoder and encoder.
• CVE-2026-94545 · Satori is a library to convert HTML and CSS to SVG.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Next.js — August 2026 Security Release (Aug 25, 2026) nextjs.org
2. Next.js — Update: August Next.js Security Release nextjs.org
3. Vercel / GitHub — GHSA-p293-qw3h-jr36: Unauthenticated RCE on Windows-hosted servers (CVE-2026-75604) github.com
4. Vercel / GitHub — GHSA-2xp9-vwfh-vxw4: Unauthenticated RCE in Image Optimization API with AVIF github.com
5. libheif / GitHub — GHSA-g89c-p67h-r497: heap buffer overflow in scale_nearest_neighbor() (CVE-2026-84383) github.com
6. Vercel / GitHub — GHSA-vcvr-r3jv-pc5j: RCE in next/og ImageResponse github.com
7. CVE record — CVE-2026-75604 cve.org
8. CVE record — CVE-2026-94545 (Satori improper escaping) cve.org
9. Next.js — v16.3.6 release github.com
10. Next.js — PR #97931: Re-enable AVIF image optimization github.com
11. sharp-libvips — v1.3.3 release (libheif 1.23.2) github.com
12. Next.js — Security Update for Upstream Vulnerabilities (Oct 14, 2026) nextjs.org
13. Next.js docs — Data security: overwriting encryption keys nextjs.org
14. Netlify — Security Update: Two critical Next.js vulnerabilities netlify.com