Two vulnerabilities affecting .js were disclosed in the August 2026 Security Release. .js applications hosted on Vercel are protected and require no customer action.
.js disclosed the following critical vulnerabilities:
GHSA-2xp9-vwfh-vxw4 originates in the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input.
CVE-2026-75604 ( GHSA-p293-qw3h-jr36 ) can lead to unauthenticated remote code execution on Windows-hosted .js servers in applications using the Pages Router and App Router without Cache Components.
After the AVIF vulnerability was identified, Vercel applied protections to its managed Image Optimization service.
Applications hosted on Vercel are protected. No upgrades, configuration changes, or redeploys are required.
Once the AVIF vulnerability was identified, Vercel disabled AVIF optimization across its managed Image Optimization service. AVIF inputs are served as-is and do not pass through the affected processing path.
The second vulnerability only affects servers using a Windows filesystem. Vercel's .js runtime uses Linux and is not affected.
Self-hosted .js applications should upgrade to the appropriate patched version.
For applications running .js 15.x or earlier:
For applications running .js 16.x:
In the patched releases, AVIF images are not resized or optimized. They are served as-is until a fixed libheif version is available. There is no workaround for the Windows vulnerability; affected servers should upgrade immediately.
Thanks to the Hacktron team for responsibly disclosing the AVIF vulnerability, and to evolutionstorm and B0RI for responsibly disclosing the Windows vulnerability.
.js August 2026 security release
Upstream libheif advisory
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
