Tag: GHSA-2xp9-vwfh-vxw4

Critical CVEs

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both enabling unauthenticated remote code execution (RCE). The…

AVIF B0RI CVE-2026-58231 CVE-2026-75604

August 27, 2026

Critical CVEs

GHSA-2xp9-vwfh-vxw4: Next.js AVIF Image Processing Heap Buffer Overflow

A critical heap buffer overflow in libheif (CVSS v4 9.5) exploited via crafted AVIF images leads to remote code execution in Next.js…

AVIF GHSA-2xp9-vwfh-vxw4 heap buffer overflow libheif

August 27, 2026