Recent security vulnerabilities in Next.js pose significant risks by enabling remote code execution on Windows-hosted applications. These issues, primarily affecting the Image Optimization API, demand urgent attention from developers and system administrators.
Detailed Analysis of CVE-2026-75604
The first major vulnerability, identified as CVE-2026-75604, affects Next.js applications utilizing the Pages Router or App Router without Cache Components. This flaw is particularly critical on systems using a Windows filesystem. GitHub has classified this vulnerability as critical, associating it with the CWE-22 path traversal issue.
This vulnerability arises when user-controlled input is used to construct file paths without adequately limiting special path elements, potentially allowing access to unintended directories. Despite the high attack complexity rated by the GHSA-p293-qw3h-jr36 advisory, the vulnerability can be exploited remotely without authentication or user interaction, posing serious risks to data confidentiality and application integrity.
Affected versions include Next.js from 13.4 to 15.5.24 and from 16.0 to 16.3.3, excluding the specific fixed versions. The flaw could lead to unauthorized data exposure, server-side content alterations, or disruptions in application availability.
Vercel’s Response and Recommendations
In response, Vercel has addressed this issue in Next.js versions 15.5.24 and 16.3.3. For applications hosted on Windows, an immediate upgrade is the only recommended course of action, as there are no available workarounds.
A second advisory, GHSA-2xp9-vwfh-vxw4, highlights vulnerabilities in the Next.js Image Optimization API for AVIF files. The root cause lies in the libheif library, utilized by the Sharp package for image processing. A malicious AVIF image submitted to a vulnerable endpoint could trigger remote code execution if processed by the affected libheif component.
Mitigation and Future Outlook
The vulnerability impacts Next.js versions from 10.0.0 up to, but not including, 15.5.24 and versions preceding 16.3.3. As an interim measure, Next.js has disabled AVIF optimization until the dependency fix is fully implemented. However, it is crucial for organizations to update their Next.js applications, refresh dependency lockfiles, and ensure all active workloads are running the latest patched releases.
Security teams should conduct comprehensive reviews of public image upload paths, assess the exposure of the Next.js Image Optimization API, and examine logs for any unusual patterns indicative of path traversal or AVIF processing issues. This proactive approach is essential to prevent security incidents and maintain application integrity.
These advisories were highlighted by researchers known as evolutionstorm and B0RI, underscoring the importance of integrating threat intelligence into security operations centers to enhance response capabilities.
