SECURITY Signal 103
Vercel applications are protected from Next.js August 2026 security vulnerabilities
↗
Vercel disabled AVIF processing and confirmed its Linux runtime blocks two Next.js remote-code-execution flaws without user intervention.
Engineers running Next.js on Vercel can skip emergency upgrades, but self-hosted deployments, especially on Windows, must patch immediately. The event highlights the operational trade-off between managed hosting and self-hosted control.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Vercel’s managed Image Optimization service now serves AVIF files unprocessed, sidestepping the libheif RCE vulnerability.
The Windows-only CVE-2026-75604 does not affect Vercel’s Linux-based runtime, so no redeploy is needed.
Self-hosted Next.js servers must upgrade to patched versions; AVIF optimization is disabled until libheif is fixed.
THE READ
What the cluster adds up to.
Two critical remote-code-execution vulnerabilities were disclosed in Next.js. The first stems from an upstream libheif flaw that can be triggered by a maliciously crafted AVIF image during Image Optimization. The second affects only Windows-hosted Next.js servers, regardless of router choice, and has no workaround other than upgrading.
Vercel-hosted applications are shielded by two architectural decisions. The platform’s managed Image Optimization service was updated to bypass AVIF processing entirely, serving the files as-is. Additionally, Vercel’s Next.js runtime runs on Linux, so the Windows-specific vulnerability cannot execute. No customer action, upgrade, configuration change, or redeploy, is required.
Self-hosted Next.js deployments face an immediate patching burden. The patched releases disable AVIF optimization until a fixed libheif version is available, trading functionality for security. Windows servers are particularly exposed; the advisory offers no mitigation beyond upgrading. The contrast between zero-effort protection on Vercel and urgent manual intervention elsewhere underscores the operational cost of self-hosting during critical vulnerabilities.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER