Vercel has patched two vulnerabilities in Next.js, a popular React framework for web application development. The first vulnerability, CVE-2026-75604, allows attackers to execute arbitrary code on the application server. It specifically affects Next.js applications hosted on Windows environments using both Pages and App routers without the Cache Component. The second vulnerability, which had not yet received a CVE identifier at time of publication, also enables remote code execution by supplying a malicious media file to a vulnerable application. Both vulnerabilities have been resolved by Vercel. Users of Next.js, especially those on Windows-based deployments, are advised to update immediately.
