---
title: "Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)"
url: https://erroneo.us/security/briefs/nextjs-windows-avif-next-og-rce/
description: "Next.js 15.5.24/16.3.3 fix unauthenticated RCE on Windows hosts and via AVIF image optimization; 16.3.6 fixes a next/og RCE. Self-hosters: upgrade."
type: security-brief
section: "Security Digest"
date_published: 2026-08-25
date_modified: 2026-09-30
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-75604", "CVE-2026-84383", "CVE-2026-94545"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)

**Verdict: Patch this week.** Self-hosted Next.js apps still below 15.5.24 or 16.3.3 should upgrade now, ideally straight to the October releases; Windows hosts and apps optimizing untrusted AVIF images are the urgent cases.

- **Who must act:** Teams self-hosting Next.js 13.4+ on Windows, anyone serving the built-in Image Optimization API (next start, standalone, containers) on Next.js 10 through 16.3.2, and Next.js 16.2+ apps that put request data into Node.js next/og images.
- **Who can relax:** Netlify-hosted sites (Netlify says neither August bug reaches its platform), static exports with no Next.js server, Linux or macOS hosts for the Windows bug, and Edge-runtime ImageResponse users for the next/og bug.
- **Affected:** next 13.4.0 to before 15.5.24 and 16.0.0 to before 16.3.3 on Windows hosts (CVE-2026-75604); next 10.0.0 to before 15.5.24 and 16.x before 16.3.3 (AVIF optimization via libheif); next 16.2.0 to before 16.3.6 (Node.js next/og ImageResponse, via Satori before 0.33.5); libheif 1.22.0 to before 1.23.2 (CVE-2026-84383)
- **Fixed:** next 15.5.24 and 16.3.3 (Aug 25, 2026); next 16.3.6 (Sep 22, 2026); sharp 0.35.4 (bundles libheif 1.23.2); libheif 1.23.2; Satori 0.33.5; Later releases such as next 15.5.28 and 16.4.1 include these fixes
- **CVEs:** CVE-2026-75604, CVE-2026-84383, CVE-2026-94545
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Run npm ls next sharp satori in every Next.js service and note which ones are self-hosted.
2. Upgrade: npm install next@15.5.28 or next@16.4.1 (minimums for these bugs: 15.5.24, 16.3.3, and 16.3.6 for next/og), then rebuild and redeploy.
3. On Windows hosts, treat any unpatched, internet-facing server as possibly exposed: rebuild, and rotate NEXT_SERVER_ACTIONS_ENCRYPTION_KEY if you pin it.
4. If you cannot upgrade a 16.2+ app yet, stop passing request data into SVG content, attributes or styles rendered by the Node.js ImageResponse.
5. Update any system libheif on image-processing hosts to 1.23.2 or later.

### How to check if you are affected

- npm ls next sharp satori, and compare against 15.5.24, 16.3.3, 16.3.6, sharp 0.35.4 and Satori 0.33.5.
- On Windows-hosted servers, search access logs for encoded backslashes (%5C) in route segments, and check for reads of build files outside the cache directory.
- Review /_next/image logs for AVIF sources from unexpected hosts or uploads, and for crashed or restarted image workers.
- Hunt for unexpected child processes or outbound connections from the Next.js server process.

## What happened

On August 25, 2026, Vercel shipped the [Next.js August security release](https://nextjs.org/blog/august-2026-security-release), versions 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS). It fixes two critical bugs that allow unauthenticated remote code execution. The release had been announced for August 26. It was [moved forward a day](https://nextjs.org/blog/nextjs-security-release-august-2026-update) after a second critical issue turned up in an upstream dependency. A third critical RCE, in `next/og`, followed on September 22 in 16.3.6. GitHub's global advisory database listed the August pair on September 8 and the `next/og` one on September 30.

- **CVE-2026-75604 / [GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)** (CVSS 3.1 9.0). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-75604) says Next.js on Windows does not consistently escape backslashes in route segments before it builds incremental-cache paths. A request with encoded Windows path separators can escape the cache root and read private build data, including the server-reference-manifest encryption key, and that leak can lead to RCE. It affects 13.4.0 up to 15.5.24 and 16.x before 16.3.3, in apps using the Pages Router or the App Router without Cache Components. Linux and macOS are not affected, and there is no workaround.
- **[GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)** (CVSS 4.0 9.5, no Next.js CVE). Optimizing an attacker-controlled AVIF image can lead to RCE through `libheif`, which `sharp` uses. The root bug is [CVE-2026-84383](https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497), a heap out-of-bounds write in libheif 1.22.0 to 1.23.1, fixed in 1.23.2. Its advisory says, "We were able to get RCE using this on multiple applications." Next.js 15.5.24 and 16.3.3 simply disabled AVIF optimization. [PR #97931](https://github.com/vercel/next.js/pull/97931), merged August 26, turned it back on and required `sharp` ^0.35.4, which bundles [libheif 1.23.2](https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3).
- **[GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)** (CVSS 4.0 9.5). The Node.js `ImageResponse` in `next/og` inherits [CVE-2026-94545](https://www.cve.org/CVERecord?id=CVE-2026-94545), improper escaping in Satori's SVG output (fixed in Satori 0.33.5). Apps are exposed only if they pass attacker-controlled values into SVG content, attributes or styles. It affects 16.2.0 up to 16.3.6 and was fixed in [v16.3.6](https://github.com/vercel/next.js/releases/tag/v16.3.6).

## Who is affected

Self-hosted Next.js is the main concern: `next start`, standalone output, Docker images and Windows servers. [Netlify](https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/) says its sites are not affected by either August bug. Its functions run on Linux, and it rewrites `/_next/image` to its own image CDN. Vercel's posts don't address Vercel-hosted deployments. Next.js 15.x is outside the `next/og` range.

## Do you really need to act?

Each bug has preconditions, which is why every vector includes "attack requirements: present" or "high complexity". The Windows bug needs a Windows host and nothing else from the attacker. The AVIF bug needs the optimizer to process an AVIF the attacker controls, through an allowed remote host or user uploads served as local images. The `next/og` bug needs your code to put untrusted input into SVG. No exploitation was reported for any of them as of October 21, 2026, and none is in CISA KEV. But the fixes are two months old, and the [October 14 release](https://nextjs.org/blog/nextjs-security-update-october-14-2026) (16.4.1 / 15.5.28) fixes two more critical RCEs. A service still below 15.5.24 or 16.3.3 is now behind on four critical fixes.

## What to do now

1. Find versions: `npm ls next sharp satori` in each app, or `pnpm why next`.
2. Upgrade to the current line: `npm install next@16.4.1` or `npm install next@15.5.28`, then rebuild and redeploy the image. Bumping the version without redeploying fixes nothing.
3. For Windows hosts that were exposed while unpatched, rebuild and redeploy. The [Next.js docs](https://nextjs.org/docs/app/guides/data-security) say a new Server Actions key is generated on every build unless `NEXT_SERVER_ACTIONS_ENCRYPTION_KEY` pins it, so rotate that variable if you set it (`openssl rand -base64 32`).
4. Until a 16.2+ app is upgraded, keep request data out of SVG markup rendered by the Node.js `ImageResponse`, or render with the Edge runtime.
5. Update any system libheif on image-processing hosts to 1.23.2 or later.

## How to tell if you were hit

On Windows hosts, search access logs for encoded backslashes (`%5C`) in route segments. Also check file-access auditing for reads of `.next` build files outside the cache directory. For the AVIF path, review `/_next/image` requests for AVIF sources from unexpected hosts or recent uploads, and look for crashed or restarted image workers. In all cases, investigate unexpected child processes, shells or outbound connections spawned by the Node.js server, and rotate secrets the process could read if you find any.

## Timeline

- Aug 25, 2026 — Next.js moves the release forward a day. 16.3.3 and 15.5.24 ship around 16:17 UTC, and libheif publishes 1.23.2's advisory.
- Aug 26, 2026 — sharp 0.35.4 ships with libheif 1.23.2, and Next.js merges the change that re-enables AVIF.
- Sep 1, 2026 — CVE-2026-75604 is published.
- Sep 8, 2026 — GitHub's advisory database lists the two August advisories.
- Sep 22, 2026 — Next.js 16.3.6 fixes the `next/og` RCE.
- Sep 30, 2026 — CVE-2026-94545 and the global `next/og` advisory are published.

## Sources

1. [Next.js — August 2026 Security Release (Aug 25, 2026)](https://nextjs.org/blog/august-2026-security-release)
2. [Next.js — Update: August Next.js Security Release](https://nextjs.org/blog/nextjs-security-release-august-2026-update)
3. [Vercel / GitHub — GHSA-p293-qw3h-jr36: Unauthenticated RCE on Windows-hosted servers (CVE-2026-75604)](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)
4. [Vercel / GitHub — GHSA-2xp9-vwfh-vxw4: Unauthenticated RCE in Image Optimization API with AVIF](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
5. [libheif / GitHub — GHSA-g89c-p67h-r497: heap buffer overflow in scale_nearest_neighbor() (CVE-2026-84383)](https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497)
6. [Vercel / GitHub — GHSA-vcvr-r3jv-pc5j: RCE in next/og ImageResponse](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)
7. [CVE record — CVE-2026-75604](https://www.cve.org/CVERecord?id=CVE-2026-75604)
8. [CVE record — CVE-2026-94545 (Satori improper escaping)](https://www.cve.org/CVERecord?id=CVE-2026-94545)
9. [Next.js — v16.3.6 release](https://github.com/vercel/next.js/releases/tag/v16.3.6)
10. [Next.js — PR #97931: Re-enable AVIF image optimization](https://github.com/vercel/next.js/pull/97931)
11. [sharp-libvips — v1.3.3 release (libheif 1.23.2)](https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3)
12. [Next.js — Security Update for Upstream Vulnerabilities (Oct 14, 2026)](https://nextjs.org/blog/nextjs-security-update-october-14-2026)
13. [Next.js docs — Data security: overwriting encryption keys](https://nextjs.org/docs/app/guides/data-security)
14. [Netlify — Security Update: Two critical Next.js vulnerabilities](https://www.netlify.com/changelog/2026-08-25-nextjs-security-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/nextjs-windows-avif-next-og-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt