Next.js moved its patch a day early, and the count went from one critical hole to two
Versions 16.3.3 and 15.5.24 shipped on August 25 instead of the announced August 26. A second unauthenticated remote code execution had turned up in an upstream library, and the patched releases switch AVIF image optimization off until that library is fixed.
Vercel had published the date before the fix: August 26, one critical vulnerability, announced a week ahead so teams could schedule the upgrade rather than meet it in a CVE feed. On August 25 the schedule changed. A second critical vulnerability had been found in an upstream dependency, and both were shipped in the same release so that anyone running Next.js would need to upgrade only once.
Two holes, and neither one needs a login
The first is in image optimization. The libheif library, reached through sharp, can be driven into remote code execution when Next.js optimizes an AVIF image that an attacker controls. The advisory is blunt about the remedy: the patched releases disable AVIF optimization altogether until a fix upstream propagates. It carries two identifiers, GHSA-2xp9-vwfh-vxw4 on the Next.js side and GHSA-g89c-p67h-r497 on libheif.
The second, CVE-2026-75604, only reaches servers on a Windows filesystem, and only applications that use the Pages Router and the App Router together without Cache Components. Linux and macOS are not affected. For the applications that are, the advisory states there is no known workaround.
The patch has a price, and it is stated openly
Turning AVIF optimization off is not a side effect of the fix, it is the fix. A site that serves AVIF through the built-in image optimizer will fall back to other formats after the upgrade, which means larger files on the same pages until libheif lands and Next.js turns the format back on.
That is the trade the release makes for you, and it is worth knowing before the upgrade rather than after, because the change shows up as a quiet regression in image weight rather than as an error.
Sources
Related
Both SDKs left httpx within twelve days, and the plugins had to follow
llm-anthropic 0.27 landed on August 24 and now requires anthropic 1.x, which moved from httpx to httpx2. OpenAI made the same move in its 3.0.0 on August 12. If you keep both plugins in one environment, they no longer upgrade independently.
Simon Willisonverified
llm 0.33 takes the pin out and moves to httpx2
Version 0.32.1 held fresh installs together by pinning the OpenAI Python package below 3.0.0. That was a holding action, and 0.33 does the actual repair: it upgrades to the OpenAI library 3.x and switches its HTTP client from httpx to httpx2. The release also carries changes you will notice in daily use, including a --key option on the embedding commands and server-side tool results that finally show up in llm logs.
Simon Willisonverified
A fresh install of llm broke because the OpenAI library stopped using httpx
Version 0.32.1 pins the OpenAI Python package below 3.0.0 so that new installations work again. Nothing in llm changed to cause the break: it imported httpx while relying on the OpenAI package to bring it along, and when that package dropped httpx the dependency simply stopped arriving. It is a small release with a lesson that outlives it.
Simon Willisonverified