Next.js shipped versions 16.3.3 and 15.5.24 on 25 August 2026, pulling a security release forward by a day from its planned 26 August date. The reason for the rush: a second critical flaw, found while the update was being prepared, was folded into the same release. Both vulnerabilities allow unauthenticated remote code execution, and no workaround is a lasting substitute for upgrading.
Two remote code executions, no authentication
The advisory published on the official repository describes two distinct flaws, both rated critical:
- RCE on Windows-hosted servers (
GHSA-p293-qw3h-jr36): a path manipulation makes it possible, on a Windows filesystem, to run code on the server without authenticating. - RCE through the Image Optimization API (
GHSA-2xp9-vwfh-vxw4): a crafted AVIF file, processed by the image optimization chain, leads to code execution. The defect comes from the decoding library used downstream.
What makes this serious is the shared trait: in both cases the attack needs no account and no valid session. An exposed, unpatched application is reachable directly.
Two critical flaws, no authentication required: on an exposed Next.js application, the window between advisory and exploitation is measured in hours.
Who is affected
Every version before the fixes is vulnerable: the 15 branch below 15.5.24, the 16 branch below 16.3.3. The AVIF optimization flaw reaches back to considerably older versions than the Windows one; in practice, a codebase that has not been updated recently carries both exposures at once.
| Flaw | Nature | Exposed surface | Fixed in |
|---|---|---|---|
GHSA-p293-qw3h-jr36 | Unauthenticated RCE | Windows-hosted servers | 16.3.3 · 15.5.24 |
GHSA-2xp9-vwfh-vxw4 | Unauthenticated RCE | Image Optimization API (AVIF) | 16.3.3 · 15.5.24 |
Fixing it: upgrade first
The only complete response is the version bump. Since both flaws are fixed in the same release, a single upgrade closes both doors.
# branche 16 (Active LTS)
npm install [email protected]
# branche 15 (Maintenance LTS)
npm install [email protected]
# équivalents pnpm / yarn
pnpm add [email protected]
yarn add [email protected]
If upgrading can’t be immediate. For the AVIF flaw only, removing AVIF from the formats served by the image optimizer shrinks the attack surface while you patch. It is a partial mitigation, not a fix: it does not cover the Windows flaw.
// next.config.js — atténuation temporaire de la faille AVIF
module.exports = {
images: { formats: ['image/webp'] }, // ne plus servir d'AVIF optimisé
};
What to take away
Two unauthenticated remote code executions fixed at once, across both maintained Next.js branches: today’s priority is to check the production version and move to 16.3.3 or 15.5.24. The AVIF workaround buys time, but it does not replace patching, and it leaves the Windows flaw open.
On the projects I host, an advisory like this triggers a simple routine I recommend to everyone: an npm ls next to learn the real production version, then the upgrade straight away, regression tests included. Two RCEs without authentication is exactly the profile an automated scanner exploits at scale within hours of disclosure — waiting for the next deployment window is not an option here. — Simon Janvier
Further reading: the official Next.js security announcement and the detailed advisories published on the vercel/next.js repository.
