Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
- ID
- 18737
- Status
- summarized
- Published
- 27 Aug 2026, 11:13 PM
- Fetched
- 28 Aug 2026, 2:57 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.5
- Created
- 28 Aug 2026, 2:59 AM
- Tags
- Audience
- developersvibe_coders
What happened
Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js: a heap buffer overflow in libheif triggered by crafted AVIF images (CVSS 9.5, affects all deployments), and a Windows path traversal flaw (CVE-2026-75604, CVSS 9.0, affects only Windows-hosted servers). Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026; Vercel-hosted apps are already protected.
Why it matters
If you self-host Next.js anywhere outside Vercel—especially on Windows—upgrade to 15.5.24 or 16.3.3 immediately, as there is no workaround for the Windows path traversal. Even on Linux/macOS, the AVIF flaw means any endpoint that accepts user-uploaded or remote-fetched images for optimization is an unauthenticated RCE vector.
Discussion angle
How many teams in this community self-host Next.js on Windows VMs or containers, and do their image optimization endpoints expose the AVIF attack surface to unauthenticated users?