Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE — [https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYbQmCgjQOeGU5sXrRR
What’s new: Vercel has released security patches for two critical vulnerabilities in the Next.js framework that allow unauthenticated remote code execution (RCE). The first vulnerability, tracked as CVE-2026-75604, is a path traversal flaw affecting Windows filesystem deployments. The second involves a heap buffer overflow in the libheif library used for AVIF image processing, allowing RCE through specially crafted AVIF files. The vulnerabilities affect Next.js versions 13.4 through 15.5.23 and 16.0 through 16.3.2. The patches are available in Next.js versions 15.5.24 and 16.3.3, released on August 25, 2026.
Who’s affected
Next.js applications hosted on Windows using both the Pages Router and App Router without Cache Components are affected by CVE-2026-75604. Additionally, any Next.js application that processes AVIF images using versions 10.0.0 through 15.5.23 and 16.0 through 16.3.2 is vulnerable to the AVIF image processing flaw.
What to do
- Upgrade to Next.js 15.5.24 or 16.3.3 immediately if your application is hosted on Windows or processes AVIF images.
- Run the following commands to upgrade:
npm install next@15.5.24for version 15.5 ornpm install next@16.3.3for version 16.3. - For applications hosted on Vercel, no action is required as they are already protected.
