Critical Next.js Vulnerabilities Patched in 15.5.24 and 16.3.3

The Next.js team disclosed two critical-severity vulnerabilities on August 25, both enabling unauthenticated remote code execution. Patches landed in Next.js 15.5.24 and 16.3.3.

What changed. One of the CVEs is Windows-specific (affecting the filesystem handler); the other involves the image optimization pipeline. Neither requires authentication to exploit if the vulnerable code path is reachable.

Platform response. Vercel published a changelog entry stating that Vercel-deployed applications are protected by default and no action is required on their platform. Netlify confirmed their hosted sites are not affected by the Windows issue and don't run the vulnerable Next.js code path for the image CVE — but still recommend upgrading. Both advisories went up on August 25.

Why a builder cares. These are critical-severity CVEs in the most popular React framework. If you self-host Next.js or run it outside Vercel/Netlify, upgrade to 15.5.24 or 16.3.3 immediately. Even on those platforms, upgrading your dependency is the safe call — platform-level protections may not cover every custom configuration.