Vercel patches two critical Next.js flaws enabling unauthenticated remote code execution
This digest was compiled by AI from multiple sources — links to the originals are below.
Vercel released security patches for two critical vulnerabilities in the Next.js web framework on August 25, 2026. Both flaws allow unauthenticated remote code execution, one via crafted AVIF images and the other through a Windows path traversal. The fixes are available in Next.js 15.5.24 and 16.3.3.
Key Facts
- CVE-2026-75604, a Windows path traversal flaw with CVSS 9.0, affects Next.js apps using Pages Router and App Router without Cache Components on Windows filesystems.
- The AVIF flaw, GHSA-2xp9-vwfh-vxw4 with CVSS v4 9.5, is a heap buffer overflow in libheif that can lead to remote code execution when Next.js processes a malicious AVIF image.
- Patched versions are Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published on August 25, 2026.
- The Windows vulnerability affects Next.js versions 13.4 through 15.5.23 and 16.0 through 16.3.2; the AVIF flaw affects versions 10.0.0 through 15.5.23 and all 16.x through 16.3.2.
- Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade, according to Vercel's changelog.
Windows Path Traversal
CVE-2026-75604 carries a CVSS score of 9.0 and affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server runs on a Windows filesystem. Linux and macOS deployments are not affected by this vulnerability. Vercel stated there is no known workaround for affected Windows-hosted applications and advised immediate upgrade. The attack mechanism was not disclosed in the advisory, but Vercel credited researchers evolutionstorm and B0RI with responsible disclosure.
AVIF Image Optimization Flaw
Next.js uses the sharp image processing package, which relies on the libheif C library to parse AVIF files. A critical heap buffer overflow in libheif, tracked as GHSA-g89c-p67h-r497, can lead to remote code execution when Next.js processes an attacker-controlled AVIF image. All libheif versions through v1.23.1 are affected, and the AVIF advisory covers Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. A crafted AVIF file with nested identity-derivation and auxiliary item references causes libheif to build a decoded image with two Alpha plane entries at different bit depths, leading to a heap buffer overflow that overwrites approximately 16,384 bytes past the allocation boundary. Researchers rootxharsh and KarimPwnz released a full Python proof-of-concept that reproduces the heap corruption under an address sanitizer build.
Patch Availability
The fixes are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published on August 25, 2026. Affected users can upgrade by running npm install [email protected] for the 15.5 line or npm install [email protected] for the 16.3 line. Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade, according to Vercel's changelog entry published August 25.
1 source
Vercel patches two critical Next.js flaws enabling unauthenticated remote code execution
