Infrastructure, domains & the recurring invoice of civilisation

The Hosting Times

Independent reporting on web hosting, domains and the infrastructure behind the internet.

Security

Next.js Critical Patches Put Self-Hosted Apps on Upgrade Clock

August 26, 2026 ·
Next.js Critical Patches Put Self-Hosted Apps on Upgrade Clock

Original Hosting Times illustration.

Self-hosted Next.js operators have a new security maintenance window to schedule. The Next.js project published its August 2026 security release on August 25, telling users to upgrade to Next.js 16.3.3 on Active LTS or 15.5.24 on Maintenance LTS to address two critical-severity vulnerabilities.

The hosting angle is straightforward: the fixes matter most for teams running their own Next.js servers, custom container images, Windows-hosted deployments, or image-optimization paths outside a managed platform. Vercel said applications hosted on its platform are already protected and require no redeploy, but that does not extend automatically to self-managed VPS, dedicated-server, PaaS, or private-cloud deployments.

What changed

According to Vercel’s changelog, one issue is tied to the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. Vercel said it disabled AVIF optimization in its managed Image Optimization service so affected AVIF inputs are served as-is rather than passing through the vulnerable processing path.

The second issue, identified by Vercel as CVE-2026-75604, can lead to unauthenticated remote code execution on Windows-hosted Next.js servers in applications using the Pages Router and App Router without Cache Components. Vercel said its own Next.js runtime uses Linux and is not affected by that Windows-filesystem issue.

What hosts and site owners should do

  • Upgrade self-hosted Next.js applications to 16.3.3 or 15.5.24, depending on the release line in use.
  • Prioritize internet-facing apps that accept or transform user-supplied images, especially AVIF inputs.
  • Review any Windows-hosted Next.js deployments separately from Linux-hosted fleets.
  • If using a managed host or deployment platform, confirm whether its runtime, image optimization layer, and build images have already been mitigated.

For shared-hosting and managed-WordPress providers that also sell Node.js or application hosting, this is the kind of framework advisory that should flow into customer notices, base-image rebuilds, and support playbooks. The vulnerable surface is not a generic cloud feature; it sits close to the web request path.

Sources: Next.js August 2026 security release notice; Vercel changelog on Next.js August 2026 security vulnerabilities.