Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
August 2026 Next.js security release: patch 16.3.3
- Next.js
- Security
- Course
Instructor-curated digest, not original reporting. Optional further reading — not required for grades.
On August 25, 2026, the Next.js team published a security release and asked everyone to patch immediately. Updates landed in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) after an extra critical issue in an upstream dependency moved the date forward.
Two issues are called out: unauthenticated remote code execution in the Image Optimization API when using AVIF (a vulnerability in libheif used by sharp; the patched releases disable AVIF optimization until an upstream fix lands), and a Windows-only unauthenticated RCE when an app uses both the Pages Router and the App Router without Cache Components. Linux and macOS are not affected by the Windows issue; the post says there is no known workaround for affected Windows-hosted apps.
Most of you deploy this course on Vercel (Linux), but the habit still matters: when the Next.js blog says patch ASAP, bump next and redeploy. This digest is not a substitute for the advisory — follow the original post and the linked GHSA/CVE entries.