Vercel has dropped emergency patches for two severe vulnerabilities in the Next.js framework that enable unauthenticated remote code execution. One flaw hides in AVIF image processing and the other concerns path traversal on Windows-based servers. Both are rated critical and pose huge risks for affected deployments.
Key Vulnerabilities You Need to Know
The first vulnerability, CVE-2026-75604, targets Next.js sites using a Windows filesystem with the Pages Router and App Router (minus Cache Components). Since this issue is specific to Windows environments, Linux and macOS servers aren’t at risk. There’s currently no workaround—users must upgrade immediately if their server runs on Windows. The patch is included in Next.js versions 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released on August 25, 2026. To update, run npm install [email protected] (for 15.5 line) or npm install [email protected] (for 16.3 line).
The second flaw involves AVIF image optimization, which is enabled when the config specifies image/avif in next.config.js. Next.js relies on the sharp image processor, which in turn uses the libheif library to parse AVIF files. Libheif versions up to v1.23.1 are affected by a heap buffer overflow in the image scaler. If an attacker feeds it an AVIF image made with nested identity-derivation and auxiliary item references—designed so there are two Alpha plane entries at different bit depths—the vulnerable scaler allocates an 8-bit Alpha buffer but writes 16-bit values, causing a memory overwrite. This issue impacts Next.js versions from 10.0.0 through 15.5.23, and all 16.x releases through 16.3.2. The patch disables AVIF optimization until the upstream libheif fix is released.
Impact, Fixes & What’s Next
The patches are live as of August 25, 2026. On Vercel’s hosted platform, affected applications are already protected and don’t require manual updates. But any self-hosted Next.js app—especially on Windows or with AVIF optimization enabled—must upgrade. The security advisory did not share full exploit details, but researchers credited several groups with discovery and disclosure: evolutionstorm and B0RI for the Windows bug; rootxharsh and KarimPwnz for the AVIF issue. A Python proof-of-concept was published for the AVIF vulnerability though broader exploitation remains unconfirmed.
This rollout is part of Vercel’s monthly security release program, formalized as of July 2026. The August release was actually accelerated by one day after another critical issue was found in an upstream dependency. Previous updates—including a patch in July—covered several serious issues in Next.js versions 16.2.11 and 15.5.21.
No known exploitations have been confirmed for either bug as of August 27, 2026.
Upgrade Matrix in Brief:
• Vulnerable: Next.js 13.4→15.5.23, all 16.0→16.3.2
• Safe if upgraded to: 15.5.24 or 16.3.3
The broader context: over the past two years, Next.js has grappled with multiple high-severity flaws—from middleware bypasses to deserialization vulnerabilities—that could expose internal logic or permit attackers remote execution in server environments. These incidents highlight risks for popular web frameworks built with many dependencies.
What this means: any team using Next.js—especially self-hosting on Windows or enabling AVIF image support—has a ticking clock. With no workaround for certain configurations, the only safe path is updating. Keep an eye on libheif’s release of version 1.23.2; until then, AVIF optimization stays disabled in patched Next.js builds. This episode underscores how rapid dependency changes can slip in vulnerabilities, and why regular patch management is no longer optional for serious web platforms.
