⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

Next.js Critical Security Updates for August 2026

August 27, 2026

Next.js versions 15.5.24 and 16.3.3 address critical vulnerabilities including a Windows path traversal (CVE-2026-75604) and an AVIF image processing heap overflow. Users on Windows or with AVIF optimization enabled should upgrade immediately.

Discovered from: Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE