Skip to content

Catalog Stack Sift Security Status About Feed

Catalog / Next.js

16.3.3

25 Aug 20262 months agosecurityfixedOriginal notes

This release closes 2 security advisories

criticalUnauthenticated Remote Code Execution on windows-hosted serversCVE-2026-75604
criticalUnauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedGHSA-2xp9-vwfh-vxw4

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers
Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

What happened next

Next.js 16.3.3 was superseded 6 days later by 16.3.4. 5 releases have followed it on the 16.3.x line, about one every 7 days, which now stands at 16.3.8.

2 of those 5, on the 16.3.x line:

16.3.6Closes 1 advisory22 Sep 2026
16.3.8Closes 1 advisory30 Sep 2026

Previous: 16.3.2 Next: 16.3.4

Traceary. Change, on the record.61 products, 4,704 releases

Catalog Changelog Status How the data is collected RSS

Release notes belong to their authors and are shown here under the terms each project publishes them with. Every entry links back to the original, and a publisher can have theirs taken down.

Terms of use Privacy Copyright and removal Imprint