Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both enabling unauthenticated remote code execution (RCE). The first, CVE-2026-75604 (CVSS 9.0), is a path traversal flaw affecting Windows-hosted Next.js applications using Pages Router or App Router without Cache Components. Linux and macOS deployments are unaffected. The second is a critical heap buffer overflow in the libheif library (GHSA-g89c-p67h-r497, CVSS v4 9.5) triggered by specially crafted AVIF images processed by Next.js’s image optimization, which relies on sharp and libheif. This flaw affects Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2, but only if AVIF optimization is explicitly enabled in next.config.js. Patches are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released August 25, 2026. Applications hosted on Vercel are automatically protected. No exploitation has been reported as of August 27, 2026. The vulnerabilities were disclosed by researchers including evolutionstorm, B0RI, rootxharsh, and KarimPwnz, with credit to the Hacktron team. Vercel moved the release forward by one day after discovering the additional upstream dependency flaw. This is the second monthly security release under Vercel’s formal program announced in July 2026.