Next.js Patches Unauthenticated AVIF and Windows RCE Flaws
Next.js has patched two critical vulnerabilities that allow unauthenticated remote code execution. The first, CVE-2026-75604, has a CVSS score of 9.0 and exploits a path-traversal flaw in Next.js applications using both the Pages Router and App Router without Cache Components when deployed on a Windows filesystem. Vercel says Linux and macOS systems are not affected and that no workaround exists for vulnerable Windows-hosted applications.
Affected releases include Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2. Vercel released fixes in Next.js 15.5.24 for the Maintenance LTS line and 16.3.3 for the Active LTS line on August 25, 2026. Administrators should run `npm install next@15.5.24` or `npm install next@16.3.3`, depending on their release line. Applications hosted on Vercel are protected from both flaws and do not require upgrades. Vercel credited evolutionstorm and B0RI for disclosing the Windows vulnerability but did not publish its attack mechanism.
The second flaw, GHSA-2xp9-vwfh-vxw4, has a CVSS v4 score of 9.5 and affects Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. Next.js uses Sharp for image optimization, while Sharp relies on libheif to parse AVIF files. A malicious AVIF file containing nested identity-derivation and auxiliary-item references can make libheif construct an image with two Alpha-plane entries using different bit depths. The scaler allocates memory for the first 8-bit Alpha entry but writes 16-bit values from the second entry, producing a heap buffer overflow of roughly 16,384 bytes and potentially enabling code execution. The underlying libheif issue, GHSA-g89c-p67h-r497, affects all libheif releases through 1.23.1; rootxharsh and KarimPwnz received credit for its discovery and coordination and released a Python proof of concept.
Organizations should identify deployments running affected Next.js versions, apply the vendor fixes immediately, and review logs for unusual image-processing activity or unexpected server behavior. Post-upgrade exposure checks can include an internet port scan of reachable services and an SSL/TLS checker assessment of active web endpoints.