Critical Next.js Flaws Allow Remote Code Execution

Key Takeaways

• Two critical vulnerabilities have been discovered in Next.js, allowing unauthenticated remote code execution.
• The flaws primarily impact Next.js applications hosted on Windows servers that utilize the Image Optimization API for processing AVIF images.
• One vulnerability, CVE-2026-75604, is a path traversal issue, while the other stems from the underlying libheif library used for AVIF image processing.
• Successful exploitation could lead to data exposure, content alteration, or system disruption.
• Vercel has released patches in Next.js versions 15.5.24 and 16.3.3, and immediate upgrades are strongly recommended.

Critical Flaws Expose Next.js Applications to Remote Code Execution

Developers using Next.js are urged to update their applications following the disclosure of two critical vulnerabilities that could enable unauthenticated remote code execution. These significant security gaps primarily affect Next.js applications deployed on Windows environments that leverage the Image Optimization API, particularly when handling AVIF image files.

CVE-2026-75604: Path Traversal Vulnerability

The first identified flaw, designated as CVE-2026-75604, impacts Next.js applications configured with either the Pages Router or the App Router, specifically when not employing Cache Components. This vulnerability becomes exploitable when the affected application is hosted on a server utilizing a Windows filesystem.

GitHub has categorized this issue as critical, linking it to CWE-22, commonly known as path traversal. This class of weakness arises when an application constructs a file path using input provided by an attacker without adequately restricting special path elements. Consequently, a maliciously crafted request can compel the application to access directories or files outside its intended operational scope.

The vulnerability carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. While the GHSA-p293-qw3h-jr36 advisory rates the attack complexity as high, it’s crucial to note that exploitation can proceed remotely without requiring authentication or any user interaction. A successful breach could lead to the exposure of sensitive data, unauthorized modification of server-side content, or a complete disruption of application availability. The affected range includes Next.js versions from 13.4 up to, but not including, 15.5.24, and from 16.0 up to, but not including, 16.3.3.

AVIF Image Processing Vulnerability

A second critical advisory, GHSA-2xp9-vwfh-vxw4, details a separate but equally severe flaw. This issue specifically targets Next.js Image Optimization API deployments configured to process AVIF files. The root cause of this vulnerability lies within the underlying libheif library, which is a dependency of the Sharp image-processing package. Next.js relies on Sharp for various image operations, including resizing, conversion, and optimization.

Attackers could exploit this weakness by submitting a specially crafted malicious AVIF image to a vulnerable image optimization endpoint. If this malicious file is processed by the compromised libheif component, it could trigger remote code execution on the server. The advisory assigns a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, indicating a high potential impact across confidentiality, integrity, and availability.

This AVIF-related vulnerability impacts Next.js versions from 10.0.0 through those preceding 15.5.24, as well as releases prior to 16.3.3. Both vulnerabilities were simultaneously addressed by Vercel in Next.js versions 15.5.24 and 16.3.3. As a temporary protective measure, Next.js had disabled AVIF optimization until the dependency fix was fully propagated, though organizations should not solely rely on this interim behavior.

The vulnerabilities were independently reported by security researchers operating under the handles evolutionstorm and B0RI.

What You Should Do

• Immediate Update: Upgrade all deployed Next.js applications to versions 15.5.24 or 16.3.3 without delay. There is currently no known workaround for affected applications hosted on Windows, making an immediate upgrade the only recommended mitigation.
• Rebuild and Refresh: Rebuild all production containers and refresh dependency lockfiles to ensure that the patched releases are actively running in your workloads.
• Review Configurations: Carefully review public image upload paths and the exposure of your Next.js Image Optimization API endpoints. Pay particular attention to Next.js instances hosted on Windows servers.
• Monitor Logs: Enhance log monitoring for unusual requests that exhibit path traversal patterns or involve suspicious AVIF processing activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.