Vercel has issued important security updates addressing two critical vulnerabilities in the Next.js framework. These flaws allow unauthorized remote code execution, posing significant risks if not promptly mitigated. The vulnerabilities stem from an AVIF image processing issue and a path traversal flaw affecting Windows-based servers.
Windows Path Traversal Vulnerability
The path traversal issue, identified as CVE-2026-75604 with a CVSS score of 9.0, impacts Next.js applications using both the Pages Router and App Router on Windows servers that lack Cache Components. The flaw does not affect Linux or macOS deployments. Vercel advises immediate upgrades for Windows-hosted applications as no workarounds exist.
Updates are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released on August 25, 2026. Users can upgrade via npm commands to ensure their systems are secure. Notably, Vercel-hosted applications automatically receive protection from these vulnerabilities without needing upgrades.
AVIF Image Processing Flaw
The second vulnerability pertains to the AVIF image processing functionality in Next.js, using the sharp package dependent on the libheif library. A critical heap buffer overflow in libheif can trigger remote code execution when processing malicious AVIF images. This flaw, tracked under GHSA-2xp9-vwfh-vxw4, affects Next.js versions 10.0.0 through 15.5.23 and all 16.x versions up to 16.3.2.
Libheif’s vulnerability lies in the image scaling code, where a crafted AVIF file can cause buffer overflow, leading to potential exploitation. The patch disables AVIF optimization in Next.js until a fix from libheif is implemented. Researchers rootxharsh and KarimPwnz provided a proof-of-concept for this vulnerability.
Ongoing Security Measures
Vercel’s swift response, including moving the patch release forward by a day due to an additional critical vulnerability, underscores their commitment to security. This August update, part of Vercel’s monthly security cadence initiated in July 2026, is the second formal release, following a July update that addressed nine vulnerabilities.
Despite the recent surge in security disclosures for Next.js, including the React2Shell deserialization flaw in December 2025, no exploits of the August vulnerabilities have been reported as of August 27, 2026. Vercel’s proactive measures, alongside ongoing vulnerability research, aim to fortify the Next.js framework against emerging threats.
