cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Next.js Patches Windows Path Traversal and AVIF Flaws That Could Enable RCE

· Original article ↗

Summary

Vercel patched two critical unauthenticated RCE flaws in Next.js: a Windows-only path traversal and an AVIF-processing heap overflow in libheif. Fixed releases are 15.5.24 and 16.3.3; no exploitation had been reported by August 27, 2026.

Key points

  • CVE-2026-75604 is a Windows-only path traversal affecting specified Next.js Pages Router and App Router deployments without Cache Components; Linux and macOS are unaffected.
  • The AVIF flaw is a libheif heap buffer overflow triggered when Next.js processes a crafted AVIF image; exposure requires AVIF optimization to be enabled in the site configuration.
  • The article describes how mismatched Alpha-plane bit depths can cause an out-of-bounds write. Researchers’ claim of achieving RCE on multiple applications was not independently corroborated.
  • Next.js 15.5.24 and 16.3.3 contain the fixes. These releases disable AVIF optimization until an upstream libheif fix propagates.
  • Vercel-hosted applications were reported to be protected, while affected self-hosted deployments should upgrade; the Windows flaw has no known workaround.
  • No exploitation of either August vulnerability had been reported as of August 27, 2026.

Article Details

Vulnerability Types
  • Windows-specific path traversal
  • Heap buffer overflow in libheif image scaling
Severity
Critical; CVSS 9.0 for the Windows path traversal and CVSS v4 9.5 for the AVIF processing flaw
Affected Versions
  • Next.js 13.4 through 15.5.23 (Windows path traversal; Pages Router and App Router without Cache Components)
  • Next.js 16.0 through 16.3.2 (Windows path traversal; Pages Router and App Router without Cache Components)
  • Next.js 10.0.0 through 15.5.23 (AVIF image optimization)
  • Next.js 16.x through 16.3.2 (AVIF image optimization)
  • libheif versions through v1.23.1
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Vercel said there is no known workaround for affected Windows-hosted applications.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes unauthenticated remote code execution through flaws in Next.js applications, including RCE when an application processes an attacker-controlled AVIF image; exploitation had not been reported.

CVE

CVE-2026-75604vercel · next.jsVercel has released emergency patches for two critical unauthenticated RCE vulnerabilities in Next.js: a Windows-only path traversal issue tracked as CVE-2026-75604 and an AVIF image processing flaw in libheif.

People

B0RICredited by Vercel with responsible disclosure of the Windows path traversal vulnerability.evolutionstormCredited by Vercel with responsible disclosure of the Windows path traversal vulnerability.KarimPwnzCredited as Coordinator in the libheif advisory and associated with the Python proof-of-concept for the heap corruption.rootxharshCredited as Finder in the libheif advisory and associated with the Python proof-of-concept for the heap corruption.

Vendors

VercelVercel has released emergency patches for two critical unauthenticated RCE vulnerabilities in Next.js: a Windows-only path traversal issue tracked as CVE-2026-75604 and an AVIF image processing flaw in libheif.

Products

libheifVercel has released emergency patches for two critical unauthenticated RCE vulnerabilities in Next.js: a Windows-only path traversal issue tracked as CVE-2026-75604 and an AVIF image processing flaw in libheif.Next.jsVercel has released emergency patches for two critical unauthenticated RCE vulnerabilities in Next.js: a Windows-only path traversal issue tracked as CVE-2026-75604 and an AVIF image processing flaw in libheif.sharp#Nextjs

Related Articles