| Credit: Hacktron |
Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.
The Windows path traversal, tracked as CVE-2026-75604 (CVSS score: 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem.
Linux and macOS deployments are not affected.
“There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows,” Vercel said in its advisory.
The fixes are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published on August 25, 2026. Affected users can upgrade by running npm install next@15.5.24 for the 15.5 line or npm install next@16.3.3 for the 16.3 line.
Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade, Vercel said in a changelog entry published August 25.
The vulnerability affects Next.js versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2.
The attack mechanism was not disclosed in the advisory. Vercel’s changelog also credited the researchers evolutionstorm and B0RI with the responsible disclosure of the Windows vulnerability.
AVIF Image Optimization Flaw
Next.js uses the sharp image processing package to optimize images, and sharp relies on the libheif C library to parse AVIF files.
A critical heap buffer overflow in libheif can lead to remote code execution when Next.js processes an attacker-controlled AVIF image (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5).
The underlying vulnerability, disclosed by the libheif maintainers as GHSA-g89c-p67h-r497, involves a heap buffer overflow in the library’s image scaling code.
All libheif versions through v1.23.1 are affected. The AVIF advisory covers Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2.
A crafted AVIF file that contains nested identity-derivation and auxiliary item references causes libheif to build a decoded image with two Alpha plane entries at different bit depths.
The scaler allocates a destination buffer sized for the first, 8-bit Alpha entry but then writes 16-bit sample values from the second entry into that same buffer, overwriting approximately 16,384 bytes past the allocation boundary.
The researchers credited in the advisory, rootxharsh as Finder and KarimPwnz as Coordinator, released a full Python proof-of-concept alongside the libheif disclosure that reproduces the heap corruption under an address sanitizer build.
The libheif advisory credited rootxharsh as Finder and KarimPwnz as Coordinator, but Vercel’s changelog attributed the disclosure to the Hacktron team.
“We were able to get RCE using this on multiple applications,” the researchers said in the libheif advisory.
The proof-of-concept demonstrates the out-of-bounds write, and the researchers’ claim of remote code execution on multiple applications has not been independently corroborated.
Next.js enables AVIF optimization only when a site explicitly adds image/avif to the formats configuration in next.config.js. Deployments without that configuration are not exposed to this flaw.
The patched Next.js releases turn off AVIF optimization entirely until the upstream fix propagates from libheif. The Hacker News confirmed on August 27, 2026, via the libheif GitHub releases page that v1.23.2 had not been published.
Vercel had scheduled the August patches for August 26 as part of its monthly security cadence, but moved the release forward by one day after discovering an additional critical-severity vulnerability in one of its upstream dependencies.
“Earlier today, we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies,” Josh Story, Karim Rahal, and Sebastian Silbermann said in Vercel’s security blog post.
The August release is the second under Vercel’s formal monthly security program, which the company announced in July 2026.
“The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery,” Andrew Imm and Josh Story said in the July 13 program announcement.
The first scheduled release, published on July 21, addressed nine vulnerabilities in Next.js 16.2.11 and 15.5.21, covering denial-of-service, server-side request forgery, and middleware bypass classes.
Users already on those July patches still need the August upgrade.
Next.js has seen a run of critical security disclosures over the past two years, including a critical middleware bypass flaw in March 2025 that allowed unauthenticated attackers to skip authorization checks in self-hosted deployments.
The React2Shell deserialization flaw in React Server Components, disclosed in December 2025, carried a CVSS score of 10.0 and was actively exploited within hours of public disclosure.
No exploitation of either August vulnerability had been reported as of August 27, 2026. The Hacker News reached out to Vercel for comment and had not received a response by the time of publication.
