Next.js Critical Security Updates for August 2026
Next.js versions 15.5.24 and 16.3.3 address critical vulnerabilities including a Windows path traversal (CVE-2026-75604) and an AVIF image processing heap overflow. Users…
Tag: Next.js
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both enabling unauthenticated remote code execution (RCE). The…
CVE-2026-75604: Next.js Windows Path Traversal Enables Unauthenticated RCE
A critical path traversal vulnerability in Next.js (CVSS 9.0) affects applications using Pages Router or App Router without Cache Components on Windows…
GHSA-2xp9-vwfh-vxw4: Next.js AVIF Image Processing Heap Buffer Overflow
A critical heap buffer overflow in libheif (CVSS v4 9.5) exploited via crafted AVIF images leads to remote code execution in Next.js…
Vercel Patches Critical Next.js Vulnerabilities
Vercel released security patches for two critical Next.js vulnerabilities enabling unauthenticated RCE. The company moved its monthly security release forward by one…