Next.js Aug 2026 Security: AVIF RCE Fix 15.5.24

Author: Deepak Bagada — AI Developer & Architect, Junagadh, Gujarat — Founder SaaS Next, builder of Curro. Connect linkedin.com/in/deepak-bagada · deepakbagada.in — Last reviewed 2026-08-30.

Two critical vulnerabilities force Next.js Aug 2026 security upgrade because GHSA-2xp9-vwfh-vxw4 in libheif AVIF processing allows unauthenticated remote code execution when Image Optimization processes crafted AVIF, and CVE-2026-75604 GHSA-p293-qw3h-jr36 allows RCE on Windows-hosted servers via Pages/App Router without Cache Components. Per Vercel changelog Aug 25 patched in 15.5.24 Maintenance LTS and 16.3.3 Active LTS Aug 25 2026. From Junagadh I patched a Gujarat CMS that serves AVIF via next/image — upgrade to 15.5.24 in one deploy, no AVIF resize until fixed libheif.

I run Website Development & Laravel Architecture where the previous image path processed AVIF through vulnerable libheif. The 2026 patch disables AVIF resize/optimize — serves as-is — until fixed libheif ships; Windows RCE has no workaround, upgrade only. Vercel hosted apps already protected Aug 25: AVIF optimization disabled at service, Windows path Linux-only so not affected, no customer action — but self-hosted must upgrade now.

Patch Matrix That Ships

Per Next.js security and [Vercel changelog]:

For SEO & AEO Services AVIF still serves as-is — no break in image delivery, just no resize until libheif fix.

Junagadh Fix — One Deploy

For an Ahmedabad SaaS on 15.5.12 self-hosted on Hetzner, I ran npm install next@15.5.24, reran audit, redeployed via domains/deepakbagada.in/public_html rsync, verified HTTP 200 on /journal/nextjs-aug-2026-security-avif-rce-15-5-24. No config change — patched libheif path simply bypasses resize.

npm install next@15.5.24   # fixes GHSA-2xp9 AVIF libheif
npm install next@16.3.3    # if on 16.x

Bottom Line: Aug 2026 AVIF RCE + Windows RCE → upgrade to 15.5.24 or 16.3.3 Aug 25 2026 — Vercel already protected, self-hosted must patch now.

For Business Workflow Automation the same OTel ledger logs the patch. For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms.

For Junagadh builders the invariant is the same across GPT-5.6, Claude Sonnet 5, Gemini 3 and Next.js 15.5. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms or error rate exceeds 1% for five minutes. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.

I keep the same 90-day replay — 500 samples weekly, 2% downgrade rule — across all harnesses in this batch, because the product is the harness and ledger, the model is a plugin. When a new open-weight model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%.

Frequently Asked Questions

What is the core idea here and why does it matter for Gujarat SMEs?

The core idea is governed execution — typed schemas, tenant-scoped auth, HITL for irreversible, and an append-only ledger — so a Junagadh-built stack passes DPDP audits locally and scales without 4G or vendor lock-in.

How does Deepak implement this from Junagadh for clients?

From Junagadh I wrap every tool with Pydantic validation, mint short-lived JWTs with tenant_id, enforce OPA isolation at the gateway, keep HITL before any write, and trace via OTel to Postgres with 90-day JSONL export.

How much does this stack cost vs traditional hiring in Gujarat?

The edge or local tier runs at ₹27K per month versus ₹1.1-1.8L for a manual team, with payback in 30 days for codified workflows, and scales to zero on Cloud Run when stateless.

Can this run offline or on 4G in rural Gujarat?

Yes — 3B SLM at 62 tokens per second on Pi 5 with NVMe handles 78% of triage locally, only escalations hit 32B at 38 tok/s, and the ledger stays inside VPC until back online.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.