Two critical unauthenticated RCEs in Next.js — patch to 16.3.3 now
Both run code with no login: one via AVIF image optimization, one on Windows hosts. Vercel-hosted apps are covered; self-hosters must patch by hand.
Copy markdown
The Windows-only RCE, no login required
CVE-2026-75604 hits apps that mix the Pages Router and App Router without Cache Components when the server runs on a Windows filesystem — an unauthenticated attacker can execute code. Linux and macOS are unaffected, and there is no workaround but to patch.
AVIF optimization becomes code execution
A flaw in the libheif library behind sharp means optimizing an attacker-supplied AVIF image can run code with no auth. The patch disables AVIF optimization entirely until libheif ships an upstream fix, so AVIF delivery falls back to other formats for now.
Update now: next@16.3.3 or next@15.5.24
Run npm install next@16.3.3 on the Active LTS line or next@15.5.24 on Maintenance LTS. Vercel moved the release forward after a second critical bug surfaced in an upstream dependency, so don't wait for your usual patch window.
On Vercel? You're already protected
Vercel says apps hosted on its platform are shielded from both vulnerabilities. Everyone self-hosting Next.js — especially on Windows — needs to bump the dependency themselves.
Elsewhere: GitHub Copilot's Customize tab goes GA
The Copilot app's Customize tab is now generally available, letting teams wire in their own MCP connections so Copilot can reach the tools and data they already use.