Daily SEO Note — August 26, 2026: Next.js Patches Two Critical RCEs and Vercel Switches Off AVIF

1. SEO for Content Writers

The most consequential editorial change today is not a ranking update. Google's Search Status Dashboard shows nothing running — the August 2026 spam update finished on 21 August and no core update has replaced it. What moved instead is guidance: Google restated, on the record, that there is no separate playbook for AI Overviews and AI Mode. That removes a line item from your briefs rather than adding one.

Google repeats that AI Overviews and AI Mode need no special optimization

On 25 August, Google's John Mueller wrote that "from our POV there's nothing really special you need to do for generative AI responses in search." The comment restates what Google's own documentation already says: AI features and your website states that "There are no additional requirements to appear in AI Overviews or AI Mode, nor other special optimizations necessary," and, more bluntly, that "You don't need to create new machine readable files, AI text files, or markup to appear in these features."

This affects all content, not one vertical. The practical effect is subtractive: stop spending brief time on GEO or AEO deliverables that Google says it does not read — bespoke schema added purely for AI inclusion, or an AI-specific text file maintained alongside your sitemap. None of it is a documented input to these surfaces.

What does work is the same eligibility surface as ordinary snippets. Preview controls — nosnippet, data-nosnippet and max-snippet — remain the documented way to limit how much of a page can be quoted, and they apply to AI features too. If legal or licensing wants a page excluded from AI answers, that is the lever, and it is an editorial decision about which passages are quotable, not a technical one.

Status: standing guidance, restated 25 August 2026. The documentation itself was last updated 10 December 2025, so treat this as confirmation rather than change.

Structured data escaping just became an editorial risk

Google changed how it extracts JSON-LD: the parser now applies a single pass of HTML unescaping instead of quietly repairing double-escaped entities. Gary Illyes pointed at the governing standard, RFC 8259, section 7, and separately clarified on 25 August that Googlebot does not parse JSON at all — it downloads, and the indexer parses.

The writer-facing consequence is small and ugly. Headlines, author names, FAQ answers and product names containing an ampersand, a quotation mark or a checkmark can now surface the literal entity text in a rich result — "Bikes & Boards" rendering as the raw characters instead of the symbol — if your CMS escapes the string twice on the way into the markup. Nothing about your writing is wrong; the encoding is.

In the next brief, flag any headline, FAQ answer or byline containing an ampersand or special character for a rich-result spot check before publish. Stop assuming the CMS normalizes entities on your behalf — that auto-correction is exactly what Google removed.

Status: rolled out, announced 21 August 2026 via Google Search Central's social channels and reiterated 25 August. Worth noting for your own record-keeping: as of today this change is not reflected in Google's structured data documentation (last updated 10 December 2025) and does not appear in the documentation changelog, whose most recent August entry is the 20 August preferred sources button.

AI Overviews appear above stock charts (unconfirmed)

Community reports on 25 August describe AI Overviews rendering at the very top of the results page for stock price queries such as [GOOG stock], sitting above the price chart that has owned that slot for years. This is an observation, not an announced change, and Google has confirmed nothing. Treat it as unconfirmed.

It matters to one vertical: finance and markets coverage. If you publish market commentary or ticker explainers, the assumption that a data widget is the first thing a searcher sees no longer holds for those queries. The editorial response is not to chase the surface but to write the sentence that a summary would have to quote — a direct, dated, attributable statement of what the number is and why it moved.

Fewer PDFs are surfacing in results (unconfirmed)

Also reported on 25 August: PDF documents appear to be showing less often in Google Search, including from sources that have historically ranked well with them. Again unconfirmed, and no Google statement exists.

If your team ships research, whitepapers, manuals or rate cards as PDF-only, this is a reason to stop — a reason that was already good before this week. Publish the HTML version as the canonical, indexable artifact and keep the PDF as a download for people who want it. An HTML page can carry internal links, structured data, an author byline and an update date; a PDF carries almost none of that, and it cannot be quoted cleanly by an answer surface.

Apply to your next brief

• Delete GEO/AEO-specific deliverables from the brief template. Google documents no special markup, file or optimization for AI Overviews or AI Mode.
• Add one line to the brief: flag every headline, FAQ answer and byline containing & or a special character for a rich-result check before publish.
• For any market or ticker coverage, lead with one direct, dated, attributable sentence answering the query outright.
• Stop commissioning PDF-only deliverables. HTML is the canonical artifact; the PDF is the download.
• Use nosnippet, data-nosnippet or max-snippet when a passage should not be quotable — and decide that per passage, not per page.
• Nothing in today's ranking systems requires a rewrite: no core or spam update is running.

2. SEO for Developers

Next.js shipped an out-of-cycle security release on 25 August at 16:17 UTC — 16.3.3 and 15.5.24 — closing two critical, unauthenticated remote code execution flaws. One of them lives in the Image Optimization API, the same code path that serves your largest contentful paint, and the platform-level mitigation for it has a measurable performance cost. This is the same-day pull request.

Next.js 16.3.3 and 15.5.24 patch two critical unauthenticated RCEs

Two advisories, both critical, both unauthenticated. GHSA-p293-qw3h-jr36 (CVE-2026-75604, CVSS 9.0) is a path traversal — CWE-22 — that reaches remote code execution on Windows-hosted servers, affecting Pages and App Router without Cache Components. It hits >= 13.4 and < 15.5.24, and >= 16.0 and < 16.3.3. The advisory states plainly that there is no known workaround: if your server runs on a Windows filesystem, upgrade immediately.

GHSA-2xp9-vwfh-vxw4 (CVSS 9.5, no CVE assigned at time of writing) is the one that should worry every reader regardless of platform: a crafted AVIF file processed by the Image Optimization API can execute code on the server. The root cause is in libheif, used by sharp, so it is not a Next.js logic bug you can route around. The affected range reaches back much further — >= 10.0.0 and < 15.5.24, and anything below 16.3.3.

Breaking if ignored, in the most literal sense. The release was moved forward a day from its originally announced 26 August date when the second vulnerability was identified. Rollout status: shipped and stable.

# Next.js 16.x
npm install [email protected]

# Next.js 15.x and earlier
npm install [email protected]

# Confirm nothing transitive pinned you back
npm ls next

Vercel disabled AVIF optimization platform-wide — audit your LCP

Vercel's changelog entry of 25 August is unusually consequential for performance work. Once the AVIF vulnerability was identified, Vercel disabled AVIF optimization across its managed Image Optimization service. Applications hosted on Vercel need no upgrades, configuration changes or redeploys, and the Windows RCE does not apply because Vercel's Next.js runtime is Linux.

Non-breaking for security, quietly regressive for Core Web Vitals. If your next.config requested AVIF, those responses now fall back to WebP — the same image at a larger transfer size. On image-led templates that is precisely the byte budget that decides your Largest Contentful Paint. The symptom if you ignore it is not an error; it is an LCP drift that shows up in field data a month later and gets blamed on something else.

The action is to make the change explicit rather than implicit. Pin the formats array to WebP so local builds, self-hosted deployments and Vercel production all emit the same thing, and set a reminder to revisit when the fix propagates. Self-hosted deployments do not get Vercel's mitigation and must upgrade — that is the only route.

import type { NextConfig } from 'next'

const nextConfig: NextConfig = {
  images: {
    // 2026-08-25: AVIF optimization is disabled on Vercel's managed
    // Image Optimization service (GHSA-2xp9-vwfh-vxw4).
    // Pin WebP so self-hosted and local output matches production.
    // Revisit once the upstream libheif/sharp fix propagates.
    formats: ['image/webp'],
  },
}

export default nextConfig

Googlebot's JSON-LD extraction now unescapes HTML exactly once

Google changed its JSON-LD extraction to apply a single pass of HTML unescaping, bringing the parser in line with RFC 8259, section 7. Previously the parser would quietly unroll double-escaped entities; that auto-correction is gone. Announced 21 August 2026 through Google Search Central's social channels and reiterated on 25 August, when Gary Illyes also clarified that Googlebot itself does not parse JSON — it fetches, and the indexer parses. Rollout status: live.

Breaking for any template that HTML-escapes a string and then embeds it in JSON-LD. The symptom is silent and specific: a headline written as "Bikes &amp;amp; Boards" in the source now resolves to the literal text "Bikes &amp; Boards" instead of "Bikes & Boards", and the same applies to numeric entities. Rich results keep validating — the JSON is well-formed — but the strings inside them are wrong. Check the Rich Results Test output text, not just its pass/fail state.

The fix is at the serialization boundary. Never HTML-escape a value you are about to JSON-encode: run the raw string through your language's JSON encoder and let it produce the output. A bare ampersand is perfectly legal inside a JSON string, and a Unicode escape is equally valid if your encoder prefers one — what is not legal is an HTML entity standing in for a character. In practice that means auditing any hand-built template string that concatenates JSON-LD, which is where this bug almost always lives.

<!-- Wrong: double-escaped. The parser now resolves this to the
     literal text "Bikes &amp; Boards", entity and all. -->
<script type="application/ld+json">
{"@context":"https://schema.org","@type":"Article",
 "headline":"Bikes &amp;amp; Boards"}
</script>

<!-- Right: no HTML escaping. A raw ampersand is valid inside a
     JSON string per RFC 8259. Resolves to "Bikes & Boards". -->
<script type="application/ld+json">
{"@context":"https://schema.org","@type":"Article",
 "headline":"Bikes & Boards"}
</script>

Vercel Speed Insights gains a free tier on every plan

As of 25 August, Speed Insights includes a free tier on every plan for any number of projects — 10,000 events per team every 30 days — rather than a single project on Hobby. Deeper diagnostics, slow-route attribution, historical trends and drains/CLI access continue as Speed Insights Plus. Non-breaking; opt-in.

This is worth ten minutes because it closes a real measurement gap. CrUX only reports origins with enough traffic to clear its threshold, which leaves staging, new projects and long-tail routes invisible in field data. A free real-user monitor on every project gives you a field signal for exactly the pages CrUX will not cover — including, this week, whatever the AVIF fallback does to your image-heavy templates.

import { SpeedInsights } from '@vercel/speed-insights/next'

export default function RootLayout({
  children,
}: {
  children: React.ReactNode
}) {
  return (
    <html lang="en">
      <body>
        {children}
        <SpeedInsights />
      </body>
    </html>
  )
}

Astro 7.2.7 fixes route selection for normalized request paths

Astro 7.2.7 shipped 25 August at 19:48 UTC. It is a patch release, non-breaking, and one entry in it is worth an SEO engineer's attention: it fixes route selection for normalized request paths in adapter and development request handling. Mis-selected routes on normalized paths are a classic source of unexpected 404s and inconsistent trailing-slash resolution — the kind of status-code noise that shows up in Search Console long before anyone connects it to a framework patch.

The same release also fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies, which touches the same request-handling path. There is no configuration change: bump the dependency and re-run your status-code crawl. Rollout status: released. Classification: watch, not ship-today, unless you are already chasing phantom 404s.

Ship today

1. Upgrade Next.js to 16.3.3 or 15.5.24. Windows-hosted servers have no workaround and should be treated as urgent.
2. If self-hosted and you cannot upgrade this hour, disable AVIF optimization in next.config as an interim mitigation.
3. Pin images.formats explicitly, then check LCP field data for image-led templates over the next two weeks.
4. Audit JSON-LD serialization for double-escaped entities and fix at the encoder, not with a find-and-replace.
5. Add @vercel/speed-insights to projects that fall below the CrUX reporting threshold.
6. Bump Astro to 7.2.7 and re-run a status-code crawl to confirm no route-selection 404s remain.