Next.js Patches Two Critical Remote Code Execution Vulnerabilities

Vercel has released fixes for two critical vulnerabilities in the Next.js framework. Both let an unauthenticated attacker remotely execute arbitrary code. The patches landed in the Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS) releases, published on August 25, 2026. Applications hosted on the Vercel platform itself are protected and do not need the update.

Path traversal on Windows

The first vulnerability, CVE-2026-75604 (CVSS 9.0), affects applications that use both the Pages Router and the App Router without Cache Components, provided the server runs on a Windows file system. Deployments on Linux and macOS are not affected. There is no workaround for the affected Windows hosts — Vercel strongly recommends updating immediately. The attack mechanism is not disclosed in the advisory. Versions 13.4 through 15.5.23 and 16.0 through 16.3.2 are vulnerable.

Buffer overflow in AVIF

The second flaw (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) involves image processing. Next.js optimizes images through the sharp package, which relies on the C library libheif to parse AVIF. A heap overflow was found in libheif's scaling code: a specially crafted AVIF file with nested references makes the library build an image with two alpha channels of different bit depths. The buffer is allocated for the first, 8-bit entry, but 16-bit values from the second are written into it — overwriting roughly 16,384 bytes past the bounds of the allocated memory.

All versions of libheif up to and including 1.23.1 are affected; the fixed 1.23.2 had not yet been released at the time of publication. For that reason, the patched Next.js releases simply disable AVIF optimization entirely until the upstream fix arrives. The vulnerability only applies to sites that have explicitly added image/avif to the format settings in next.config.js. The researchers (rootxharsh and KarimPwnz from the Hacktron team) published a Python exploit that reproduces the heap corruption under address sanitizer, and claim to have achieved code execution on several applications, though there is no independent confirmation of this yet.

Context

The release was moved a day ahead of the planned schedule after another critical flaw was found in one of the dependencies. This is the second release under Vercel's monthly security program, announced in July 2026; the July release closed nine vulnerabilities. The company directly links the rise in the number of findings to research aided by large language models.

Over the past two years Next.js has weathered a string of critical disclosures — from the middleware authorization bypass in March 2025 to the React2Shell deserialization vulnerability with the maximum CVSS score of 10.0, which attackers began actively exploiting within hours of publication. As of August 27, 2026, no cases of exploitation of the August flaws have been recorded.

Source: The Hacker News