Netlify: Two Critical Next.js Vulnerabilities in August 2026 Security Release
What shipped? Two critical Next.js security advisories were published today, and Netlify released an impact assessment for sites on its platform.
What changed? Two CVEs affecting Next.js:
- CVE-2026-XXXX (Windows-only RCE): Unauthenticated remote code execution on Windows-hosted servers through a crafted request. Linux deployments are not affected.
- CVE-2026-XXXX (Image Optimization RCE): Unauthenticated remote code execution in the Image Optimization API when AVIF files are processed — affects all platforms.
Netlify has applied mitigations at the platform level for hosted sites. The recommended fix is upgrading Next.js to 15.5.24 or 16.3.3 (whichever major you're on). Netlify's assessment covers both their build platform and edge functions.
Why a builder cares? Both CVEs are critical and unauthenticated — no login required to trigger them. If you run Next.js on Netlify (or anywhere), patch today.