# August 2026 Security Release

DevFeed: [August 2026 Security Release](<https://devfeed.tech/articles/august-2026-security-release-3138.md>)

Original publisher: [Read original article](<https://nextjs.org/blog/august-2026-security-release>)

Author: Sebastian Silbermann

Published: 2026-08-25T18:00:00Z

Content type: release

Language: en

Sources: [Next.js Blog](<https://devfeed.tech/sources/next-js-blog.md>)

Topics: [Next.js](<https://devfeed.tech/topics/next-js.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>)

Tags: [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

## AI overview

Next.js released versions 16.3.3 and 15.5.24 to address critical vulnerabilities, including unauthenticated remote code execution through AVIF image optimization and on Windows-hosted servers. The patched releases disable AVIF optimization until an upstream fix is propagated.

## Source excerpt

The August 2026 security release for Next.js is now available