Next.js Patches Critical AVIF and Windows RCE Flaws

Next.js is the React framework Vercel maintains for building server-rendered web applications, and on August 25, 2026 it shipped patches for two critical, unauthenticated remote-code-execution vulnerabilities. The first, CVE-2026-75604 (GHSA-p293-qw3h-jr36), is a path traversal flaw affecting Next.js servers on Windows filesystems that use the Pages Router or App Router without Cache Components. The second, GHSA-2xp9-vwfh-vxw4, stems from a heap buffer overflow in libheif, the C library that the sharp image package uses to decode AVIF files inside Next.js Image Optimization.

Both fixes landed in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), and Vercel says applications hosted on its own platform are already protected and require no customer action, per its August 25 changelog entry.

CVE-2026-75604 stands out because Vercel's advisory states plainly there is no known workaround for affected Windows-hosted applications, leaving upgrade as the only mitigation. The bug affects Next.js versions 13.4 through 15.5.23 and 16.0 through 16.3.2, but only when the server itself runs on a Windows filesystem; Linux and macOS deployments are not affected, according to the advisory. CyberSecurityNews reported the flaw maps to CWE-22 and carries a CVSS v3.1 vector with high attack complexity (AC:H) but no privileges or user interaction required (PR:N/UI:N).

That combination means an attacker cannot authenticate or trick a user, they just need to reach a vulnerable endpoint with a crafted request. The exact exploitation mechanism was not disclosed by Vercel, and the fix was credited to researchers evolutionstorm and B0RI for responsible disclosure.

GHSA-2xp9-vwfh-vxw4 traces back to a separate advisory, GHSA-g89c-p67h-r497, published by the libheif maintainers for versions through v1.23.1. Next.js uses libheif indirectly through the sharp package whenever an application explicitly enables image/avif in the images.formats configuration of next.config.js; deployments that never enable that setting are not exposed.

According to The Hacker News, the root cause is a crafted AVIF file containing nested identity-derivation and auxiliary item references that makes libheif build a decoded image with two Alpha plane entries at different bit depths. The scaler allocates a destination buffer sized for the first 8-bit entry, then writes 16-bit values from the second entry into the same buffer, overwriting roughly 16,384 bytes past the allocation boundary. The libheif advisory (GHSA-g89c-p67h-r497) credits rootxharsh as Finder and KarimPwnz as Coordinator, who published a Python proof-of-concept reproducing the heap corruption under an address sanitizer build and said in the advisory they achieved RCE on multiple applications, though that claim has not been independently corroborated. Vercel's own changelog, however, attributed disclosure of the AVIF vulnerability to the Hacktron team, a discrepancy in credit that has not been resolved.

• Self-hosted Next.js apps on a Windows filesystem using Pages Router or App Router without Cache Components: exposed to CVE-2026-75604, no workaround, upgrade immediately.
• Any self-hosted deployment with image/avif set in next.config.js image formats: exposed to the libheif AVIF flaw regardless of operating system.
• Vercel-hosted applications: protected already; Vercel disabled AVIF optimization platform-wide and its runtime uses Linux, so the Windows bug does not apply.
• Netlify-hosted applications: not affected by either issue, per Netlify's own advisory, because Netlify Functions run on Linux and image requests are rewritten to Netlify's own Image CDN rather than the Next.js Image Optimization API.

Remediation is a version upgrade: run npm install next@15.5.24 for the 15.5 line or npm install next@16.3.3 for the 16.3 line, then rebuild and redeploy production containers. The patched releases also disable AVIF optimization entirely as a stopgap, serving AVIF inputs unresized until an upstream libheif fix ships; The Hacker News confirmed on August 27, 2026, that libheif v1.23.2 had not yet been published on the project's GitHub releases page.

Vercel engineers Josh Story, Karim Rahal, and Sebastian Silbermann wrote in the company's security blog that the team "moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies," pulling the patch date up from August 26 to August 25. Users who already applied the July 21 patches covering denial-of-service, SSRF, and middleware bypass issues still need this separate August upgrade.

This is the second release under Vercel's formal monthly security program, announced in July 2026, when Andrew Imm and Josh Story wrote that "the volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery." Next.js has had other severe disclosures in the past two years, including a critical middleware bypass in March 2025 that let unauthenticated attackers skip authorization checks in self-hosted deployments, and the React2Shell deserialization flaw in React Server Components disclosed in December 2025, which carried a maximum CVSS score of 10.0 and was actively exploited within hours of disclosure.

As of August 27, 2026, no exploitation of either August vulnerability had been reported, and The Hacker News said Vercel had not responded to a request for comment by publication time.

Both flaws allow unauthenticated remote code execution against self-hosted Next.js servers, but exposure is narrow: one requires a Windows filesystem, the other requires AVIF optimization enabled in next.config.js.

Security: Successful exploitation of either bug can hand an unauthenticated attacker code execution on the application server, with no login or user interaction required.

Vercel patched two critical unauthenticated RCE bugs in Next.js, a Windows-only path traversal flaw and a libheif-based AVIF heap overflow, in versions 15.5.24 and 16.3.3.