Next.js moved its patch a day early, and the count went from one critical hole to two
Versions 16.3.3 and 15.5.24 shipped on August 25 instead of the announced August 26. A second unauthenticated remote code execution had turned up in an upstream library, and the patched releases switch AVIF image optimization off until that library is fixed.
Vercel had published the date before the fix: August 26, one critical vulnerability, announced a week ahead so teams could schedule the upgrade rather than meet it in a CVE feed. On August 25 the schedule changed. A second critical vulnerability had been found in an upstream dependency, and both were shipped in the same release so that anyone running Next.js would need to upgrade only once.
Two holes, and neither one needs a login
The first is in image optimization. The libheif library, reached through sharp, can be driven into remote code execution when Next.js optimizes an AVIF image that an attacker controls. The advisory is blunt about the remedy: the patched releases disable AVIF optimization altogether until a fix upstream propagates. It carries two identifiers, GHSA-2xp9-vwfh-vxw4 on the Next.js side and GHSA-g89c-p67h-r497 on libheif.
The second, CVE-2026-75604, only reaches servers on a Windows filesystem, and only applications that use the Pages Router and the App Router together without Cache Components. Linux and macOS are not affected. For the applications that are, the advisory states there is no known workaround.
The patch has a price, and it is stated openly
Turning AVIF optimization off is not a side effect of the fix, it is the fix. A site that serves AVIF through the built-in image optimizer will fall back to other formats after the upgrade, which means larger files on the same pages until libheif lands and Next.js turns the format back on.
That is the trade the release makes for you, and it is worth knowing before the upgrade rather than after, because the change shows up as a quiet regression in image weight rather than as an error.
Sources
Related
Next.js announced its security release six days ahead, with one critical vulnerability
Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 were announced for August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.
Next.js Blogverified
Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports
Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.
Python Software Foundationverified
Deno's team joins Cloudflare, and the Deno runtime gets one more year of updates
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified