Vercel pushed out an unscheduled Next.js security release on August 25, 2026 -- a day earlier than the previously announced August 26 date -- covering versions 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS), and it's worth treating as urgent rather than routine because both vulnerabilities patched allow unauthenticated remote code execution. The first, tracked as GHSA-2xp9-vwfh-vxw4, lives in the AVIF image-decoding path that Next.js's built-in Image Optimization feature relies on; the bug actually originates in the upstream libheif library, but because Next.js ships that decoding logic as part of its default image pipeline, any app using next/image with AVIF sources was exposed to a maliciously crafted image triggering code execution on the server, not just a crash or a data leak. Vercel's fix in this release disables AVIF optimization outright until the upstream libheif issue is resolved, which means self-hosted deployments that upgrade will see AVIF images served unoptimized or fall back to another format rather than being silently vulnerable. The second issue, CVE-2026-75604, is specific to Windows-hosted Next.js servers running the Pages Router or the App Router without Cache Components, and stems from a filesystem-handling flaw that likewise permits unauthenticated RCE. For teams building on Next.js, the practical takeaway is to check which router and hosting combination they're running: Vercel's own platform was patched automatically for customers, but anyone self-hosting on Windows infrastructure, or running an AVIF-heavy image pipeline outside of Vercel, needs to upgrade to 16.3.3 or 15.5.24 directly rather than assuming a managed platform absorbed the fix on their behalf. It's also a reminder that Next.js has moved to a more Node.js-like practice of scheduled, cadence-based security releases this year, so watching that release calendar is now a legitimate part of keeping a production Next.js app safe.