Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN866
_____________________________________________________________________

DATE                : 28/08/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Next.js versions prior to
                          16.3.3 (Active LTS), 15.5.24.
 
=====================================================================
https://nextjs.org/blog/august-2026-security-release
_____________________________________________________________________

August 2026 Security Release


Last week we announced an upcoming security release for Next.js.
Earlier today, we moved the release forward after identifying an
additional critical severity vulnerability in one of our upstream
dependencies.

Updates are now available in v16.3.3 (Active LTS) and v15.5.24
(Maintenance LTS) to address these issues. Please patch your Next.js
dependencies to maintain the security of your applications.


Terminal

npm install next@15.5.24  # for 15.5
npm install next@16.3.3   # for 16.3


Impact

Unauthenticated Remote Code Execution in the Image Optimization API
when using AVIF (Critical Severity)

GHSA-2xp9-vwfh-vxw4 / GHSA-g89c-p67h-r497

A vulnerability in the underlying libheif library used by sharp can
lead to unauthenticated remote code execution when Next.js optimizes
an attacker-controlled AVIF image. The patched releases disable AVIF
optimization until an upstream fix is propagated.


Unauthenticated Remote Code Execution on Windows-hosted servers
(Critical Severity)

CVE-2026-75604 / GHSA-p293-qw3h-jr36

A vulnerability in applications using both the Pages Router and App
Router without Cache Components can lead to unauthenticated remote
code execution when the Next.js server uses a Windows filesystem.
Linux and macOS are not affected by this issue. There is no known
workaround for affected Windows-hosted applications.


Our security program

We work with a talented set of researchers to secure Next.js and
other open source frameworks through Vercel's Open Source Bug Bounty
. Anyone interested in contributing to the security of eligible
frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or
vulnerability management can be sent to security@vercel.com.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================