Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js: a Windows path traversal (CVE-2026-75604, CVSS 9.0) and an AVIF heap buffer overflow via libheif (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5) The Windows flaw affects Next.js apps using both Pages Router and App Router without Cache Components on Windows filesystems; Linux and macOS are unaffected The AVIF flaw stems from a heap buffer overflow in libheif's image scaling code, where a crafted AVIF file with nested identity-deriva
Analysis
TL;DR
- Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js: a Windows path traversal (CVE-2026-75604, CVSS 9.0) and an AVIF heap buffer overflow via libheif (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5)
- The Windows flaw affects Next.js apps using both Pages Router and App Router without Cache Components on Windows filesystems; Linux and macOS are unaffected
- The AVIF flaw stems from a heap buffer overflow in libheif's image scaling code, where a crafted AVIF file with nested identity-derivation and auxiliary item references causes an out-of-bounds write of ~16,384 bytes
- Fixes are available in Next.js 15.5.24 and 16.3.3; Vercel's platform is protected without requiring user upgrades
- Patched releases disable AVIF optimization entirely until the upstream libheif fix (v1.23.2) is published
Why It Matters
These vulnerabilities highlight the cascading risk of deep dependency chains in modern web frameworks, where a flaw in a low-level C library (libheif) can translate directly into unauthenticated RCE in a high-level JavaScript framework. The Windows-specific path traversal also underscores how platform-specific code paths can introduce unique attack surfaces that bypass standard security assumptions.
Technical Details
- CVE-2026-75604 (Windows Path Traversal, CVSS 9.0): Affects Next.js versions 13.4 through 15.5.23 and 16.0 through 16.3.2 running on Windows filesystems with both Pages Router and App Router (without Cache Components). No workaround exists for affected Windows-hosted applications; immediate upgrade is required. Linux and macOS deployments are not affected.
- GHSA-2xp9-vwfh-vxw4 (AVIF Heap Buffer Overflow, CVSS v4: 9.5): Next.js uses the
sharpimage processing package, which relies on thelibheifC library to parse AVIF files. A crafted AVIF file containing nested identity-derivation and auxiliary item references causes libheif to construct a decoded image with two Alpha plane entries at different bit depths (8-bit and 16-bit). The scaler allocates a destination buffer sized for the 8-bit Alpha entry but writes 16-bit sample values from the second entry, overwriting approximately 16,384 bytes past the allocation boundary. - Affected versions: The AVIF advisory covers Next.js 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. All libheif versions through v1.23.1 are vulnerable. AVIF optimization must be explicitly enabled via
image/avifinnext.config.js; deployments without this configuration are not exposed. - Mitigation strategy: Patched Next.js releases disable AVIF optimization entirely until the upstream libheif fix propagates. As of August 27, 2026, libheif v1.23.2 had not yet been published.
- Release context: The August patches were moved forward by one day from the scheduled monthly cadence after Vercel discovered an additional critical-severity vulnerability in an upstream dependency. No exploitation of either August vulnerability had been reported as of August 27, 2026.
Industry Insight
- Organizations running Next.js on Windows should treat the August upgrade as a critical priority with no acceptable delay, given the unauthenticated RCE nature of CVE-2026-75604 and the absence of any workaround.
- Teams relying on AVIF image optimization should audit their
next.config.jsconfigurations and consider temporarily disabling AVIF support until libheif v1.23.2 is released, balancing performance needs against the unresolved upstream vulnerability. - The pattern of critical vulnerabilities in Next.js over the past two years (including the March 2025 middleware bypass and December 2025 React2Shell deserialization flaw) suggests that framework maintainers should strengthen upstream dependency monitoring and consider reducing attack surface by defaulting optional features like AVIF optimization to disabled.
Disclaimer: The above content is generated by AI and is for reference only.