Next.js patches two Critical bugs: Windows hosts must upgrade, AVIF reaches everyone else

The version string in `package.json` is not an inventory. A dependency written as `^15.5.0` resolves at install time, so it can sit unchanged in the repo while the artifact behind it moves, which is why the dev.to walkthrough insists on the lockfile and the installed package instead ^[8]. The checks are cheap: `npm ls next`, or `node -p "require('next/package.json').version"`, with `pnpm list next`, `yarn why next` and a `bun pm ls` grep for the other package managers ^[9]. The examples the guide picks are 15.5.23 and 16.3.2 ^[10], each exactly one patch release short of a fix ^[20].

Then the two advisories separate. CVE-2026-75604 only bites when the server runs on a Windows filesystem, in Pages Router and App Router applications without Cache Components ^[3][4]. The AVIF advisory's floor sits three major versions lower and carries no operating system condition at all ^[21]. Combine the ranges and a Linux box on 15.5.23 is outside the Windows condition and squarely inside the AVIF one ^[12]. That is the trap in the platform check: `process.platform` returning `linux` orders the work, it does not close it, and the guide says so plainly, that a Linux production deployment is not the Windows condition and that this does not make an old version safe ^[11].

Grepping `next.config.*` for `image/avif` tells you whether the format is configured ^[13]. It does not answer the question that actually decides exposure, which is whether an untrusted party can get an AVIF into the Image Optimization path in the first place, because the advisory concerns attacker-controlled AVIF images being optimized ^[6][13]. The routes listed are ordinary product features: user-uploaded avatars, CMS-controlled images, marketplace images, image proxies, remote image domains ^[14]. If your service accepts an image URL from outside, you have one.

The sequencing advice cuts against the instinct to scope before acting. Upgrade first if the installed version is affected, and treat the configuration review as exposure mapping rather than a precondition for patching ^[15]. A security bump still earns normal release verification: the production build, the project's tests and typecheck, lint where the project already lints, and nothing invented to pad the checklist ^[17]. Install the pinned version, confirm it from Node, and commit the lockfile alongside the package change, since the lockfile is what holds CI and production on the version you reviewed ^[16].

The durable part is the last step in that guide, a CI guard that stops a vulnerable Next.js version from reaching deployment again ^[18]. Version inventory done by hand is a task you will repeat the next time an advisory lands with two different trigger conditions, one of which depends on which filesystem the runtime happens to be sitting on.