Next.js Patches Critical AVIF and Windows Path Traversal Flaws Enabling Unauthenticated RCE

What Happened

Vercel released security patches for two critical‑severity vulnerabilities in the Next.js web framework, both allowing unauthenticated remote code execution. One flaw is exploitable via specially crafted AVIF image files, the other via a path‑traversal issue on Windows file systems.[The Hacker News]

Technical Analysis

The Windows path traversal, tracked as CVE-2026-75604 (CVSS 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components on a Windows filesystem. No workaround exists; upgrade immediately if you host on Windows.[Vercel advisory]

The AVIF flaw stems from a heap buffer overflow in the libheif library used by the sharp image processing package. The vulnerability (GHSA‑2xp9‑vwfh‑vxw4, CVSS 9.5) allows remote code execution when Next.js processes a malicious AVIF image.[Next.js advisory] The underlying issue is detailed in the libheif advisory (GHSA‑g89c‑p67h‑r497). All libheif versions through v1.23.1 are affected.

Impact

Any Next.js app running on Windows that uses the Pages or App Router may be compromised without authentication. Similarly, any app that processes AVIF images with sharp is vulnerable, regardless of operating system.

How to Protect Yourself

• Upgrade to Next.js 15.5.24 (LTS) or 16.3.3 (Active LTS) released on August 25 2026. Use npm install next@15.5.24 or npm install next@16.3.3.
• If you host on Vercel, the platform has already applied the patches – no action required.
• Ensure the sharp dependency is updated to a version that bundles a fixed libheif (≥ v0.33.2).
• Audit your deployment for Windows‑specific path handling and mitigate any custom file‑system code.