Vercel has released security patches for two critical vulnerabilities in the Next.js web framework. Both vulnerabilities allow unauthenticated remote code execution (RCE). The first flaw is exploitable via specially crafted AVIF image files. The second is a path traversal vulnerability affecting Next.js servers running on Windows filesystems, tracked as CVE-2026-75604. Both issues are classified as critical severity. No authentication is required to exploit either vulnerability. The patches were released by Vercel, the maintainer of Next.js. Organizations using Next.js, especially on Windows, are urged to update immediately.
Two critical vulnerabilities were patched in Next.js on August 25, 2026. (1) AVIF Image Optimization Flaw (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5): Next.js uses the 'sharp' image processing package which depends on libheif (a C library) to parse AVIF files. A heap buffer overflow exists in libheif's image scaling code (GHSA-g89c-p67h-r497). A specially crafted AVIF file containing nested identity-derivation and auxiliary item references causes libheif to build a decoded image with two Alpha plane entries at different bit depths. The scaler allocates a destination buffer sized for the first 8-bit Alpha entry but writes 16-bit sample values from the second entry into the same buffer, overwriting approximately 16,384 bytes past the allocation boundary. This can lead to unauthenticated RCE when Next.js processes an attacker-controlled AVIF image. This flaw only affects deployments that explicitly add 'image/avif' to the formats configuration in next.config.js. All libheif versions through v1.23.1 are affected. A Python proof-of-concept reproducing heap corruption was released. The patched Next.js releases disable AVIF optimization entirely until the upstream libheif fix is available. (2) Windows Path Traversal (CVE-2026-75604, CVSS: 9.0): Affects Next.js applications using both Pages Router and App Router without Cache Components on Windows filesystem servers. Linux and macOS deployments are not affected. No workaround exists for Windows-hosted applications. The attack mechanism was not disclosed.
1. Upgrade Next.js immediately: run 'npm install next@15.5.24' for the 15.5 line or 'npm install next@16.3.3' for the 16.3 line. 2. Windows-hosted Next.js applications have no known workaround for CVE-2026-75604 and must upgrade immediately. 3. Applications hosted on Vercel's platform are already protected and do not require an upgrade. 4. For the AVIF flaw, if upgrading is not immediately possible, remove 'image/avif' from the formats configuration in next.config.js to disable AVIF image optimization. 5. Users who applied the July 2026 patches still need to apply the August 2026 upgrade. 6. Monitor for exploitation attempts involving crafted AVIF image uploads to Next.js image optimization endpoints. 7. Await the upstream libheif v1.23.2 release for the underlying AVIF heap overflow fix.
