The AVIF bug is the one I’d stare at longest. It comes from libheif, not from Next.js itself — a heap buffer overflow in heif_decode_image(), 9.8 out of 10. That’s the shape of dependency risk I keep forgetting to account for: I picked a framework, and a decoder I never chose came along with it. Vercel’s own hosting is fine because it runs Linux and doesn’t offer AVIF optimization. Self-hosters get both problems.
So: check your Next version tonight. Anything before 15.5.24 or 16.3.3 needs npm install [email protected] or [email protected]. The Windows RCE, CVE-2026-75604, has no workaround at all — patching is the whole mitigation. And Vercel moved to monthly updates in July, so this is now a recurring calendar item, not a surprise.
The story — Vercel’s August update patches two critical Next.js vulnerabilities. One, rated 9.8, is a heap buffer overflow inherited from libheif affecting AVIF image optimization. The second, CVE-2026-75604, rated 9, hits Windows installations using Pages and App Router without a cache component and has no workaround. Versions before 15.5.24 and 16.3.3 are affected. Vercel-hosted deployments are not, running Linux without AVIF optimization. (Source)