DevVercelabout 3 hours ago
Vercel shields apps from Next.js August 2026 flaws
2 min read
Two Next.js vulnerabilities disclosed in the August 2026 Security Release include GHSA-2xp9-vwfh-vxw4, enabling unauthenticated remote code execution via crafted AVIF input, and CVE-2026-75604 affecting Windows-hosted servers. Vercel disabled AVIF optimization and uses Linux, so hosted applications need no action. Self-hosted apps must upgrade immediately.
Level
Hype check
Tap to vote and see what everyone thinks.
