# Vercel Next.js security vulnerabilities > Live situation record from CLSTR: https://clstr.news/situations/vercel-nextjs-security-vulnerabilities > Updated: 2026-08-30T23:02:26.000Z. Sources: 5. Developments: 2. Vercel released security updates for Next.js to address critical vulnerabilities that could enable unauthenticated remote code execution. One major issue involves a heap buffer overflow in the AVIF image optimization process. This flaw, rated with a CVSS v4 score of 9.5, is triggered by malicious AVIF files processed via the sharp Node package and the libheif C library. To mitigate this, the latest updates disable AVIF optimization by default until a permanent upstream fix is available. Additionally, a Windows-specific path traversal vulnerability (CVE-2026-75604) was identified, carrying a CVSS score of 9.0. This flaw affects applications using the Pages Router or the App Router without Cache Components on Windows filesystems. Vercel noted, “There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.” Developers are urged to update to versions 15.5.24 or 16.3.3 to protect both cloud and self-hosted deployments. ## Timeline ### 2026-08-30: Vercel patches critical Next.js vulnerabilities Vercel has issued urgent patches for Next.js to fix two critical vulnerabilities, including a Windows path traversal flaw and an AVIF heap overflow, both capable of unauthenticated remote code execution. 3 sources. https://clstr.news/cluster/vercel-patches-critical-nextjs-vulnerabilities ### 2026-08-28: Vercel releases Next.js security updates to patch critical AVIF vulnerability Vercel released Next.js updates 16.3.3 and 15.5.24 to patch critical vulnerabilities in the libheif library that allow remote code execution via malicious AVIF images. 2 sources. https://clstr.news/cluster/vercel-releases-nextjs-security-updates-to-patch-critical-avif-vulnerability --- Cite as: Vercel Next.js security vulnerabilities. CLSTR, https://clstr.news/situations/vercel-nextjs-security-vulnerabilities