Next.js Patches Critical RCE Vulnerabilities in AVIF and Windows
Vercel fixes two critical security flaws allowing unauthenticated remote code execution.
1Critical Vulnerabilities Overview
Vercel has released security patches addressing two critical vulnerabilities in the Next.js framework. The first allows remote code execution (RCE) via specially crafted AVIF image files, while the second enables RCE through a path traversal flaw affecting Windows filesystems. Tracked as CVE-2026-75604 with a CVSS score of 9.0, the Windows vulnerability impacts Next.js applications using both Pages Router and App Router without Cache Components.
2Affected Versions
The vulnerabilities affect all Next.js versions from 13.4 through 15.5.23 and from 16.0 through 16.3.2. Patches are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released on August 25, 2026. Users can update via npm install [email protected] or npm install [email protected] commands. Applications hosted on Vercel are automatically protected and require no manual upgrade.
3Technical Details of AVIF Vulnerability
The AVIF vulnerability stems from a heap buffer overflow in the libheif library used by sharp, Next.js's image processing package. Identified as GHSA-g89c-p67h-r497, this flaw occurs when processing a malicious AVIF file containing nested identity-derivation references, causing a 16,384-byte memory overflow. Researchers rootxharsh and KarimPwnz published a Python proof-of-concept demonstrating the exploit, though independent verification of RCE claims is pending.
4Windows Path Traversal Flaw
The second vulnerability allows path traversal attacks on servers using Windows filesystems when Cache Components aren't implemented. Vercel emphasized there's no known workaround and Windows server users must upgrade immediately. Security researchers evolutionstorm and B0RI responsibly disclosed this vulnerability, which carries a CVSS score of 9.0.
5Patch Timeline and Process
Vercel initially scheduled the August patches for August 26 as part of its monthly security cadence but moved the release forward by one day after discovering an additional critical vulnerability in an upstream dependency. This marks the second release under Vercel's formal monthly security program launched in July 2026, designed to address the increasing volume of LLM-assisted vulnerability research.
6Historical Security Context
Next.js has faced multiple critical vulnerabilities in recent years. A March 2025 middleware bypass flaw allowed unauthenticated attackers to skip authorization checks in self-hosted deployments. The December 2025 React2Shell deserialization flaw, with a CVSS score of 10.0, was actively exploited within hours of disclosure, highlighting the framework's evolving security challenges.
7Current Status and Risks
As of August 27, 2026, no exploitation of either August vulnerability has been reported. However, the patched libheif version (v1.23.2) remains unpublished. Next.js has temporarily disabled AVIF optimization entirely. Since AVIF optimization only activates when explicitly configured in next.config.js, deployments without this configuration aren't exposed to this specific flaw.
8Recommendations and Implications
These vulnerabilities underscore the security risks in modern web frameworks' complex dependency chains. Windows server users must prioritize immediate updates. While Vercel's monthly security program facilitates faster patch distribution, user adoption remains critical. With LLM-assisted security research on the rise, the industry should expect more frequent discoveries of similar vulnerabilities, necessitating robust update processes and dependency management strategies.
Original article: The Hacker News — Next.js'te Kritik RCE Açıkları: AVIF ve Windows Güvenlik Yaması