Vercel has released emergency patches for two critical unauthenticated RCE vulnerabilities in Next.js: a Windows-only path traversal issue tracked as CVE-2026-75604 and an AVIF image processing flaw in libheif. The fixes in Next.js 15.5.24 and 16.3.3 protect self-hosted deployments, while Vercel-hosted apps are already safe; the update also disables AVIF optimization until upstream fixes land. #Nextjs #CVE202675604 #libheif #sharp #AVIF
Keypoints
- Two critical Next.js vulnerabilities allow unauthenticated remote code execution.
- CVE-2026-75604 affects Windows-hosted Next.js apps using Pages Router and App Router.
- The flaw does not impact Linux or macOS deployments.
- The AVIF issue comes from a heap buffer overflow in libheif used by sharp.
- Users should upgrade to Next.js 15.5.24 or 16.3.3 immediately.
Read More: https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html