Critical Next.js Vulnerabilities Enable Remote Code Execution
Two critical vulnerabilities in Next.js, CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4, allow unauthenticated remote code execution, impacting Windows-hosted applications and AVIF image processing.
Two critical vulnerabilities have been disclosed in the popular Next.js web development framework, paving the way for unauthenticated remote code execution (RCE) attacks. The flaws, identified as CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4, pose significant risks to applications hosted on Windows systems and those utilizing the Image Optimization API for AVIF image processing.
The first vulnerability, CVE-2026-75604, is a path traversal flaw that affects Next.js applications using either the Pages Router or the App Router without Cache Components, specifically when running on a Windows filesystem. Tracked under CWE-22, this weakness arises when an application fails to adequately sanitize user-supplied input used in file path construction. An attacker can craft a malicious request to trick the application into accessing files and directories outside its intended scope. The vulnerability carries a CVSS v3.1 score of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating a high potential impact on confidentiality, integrity, and availability, despite a high attack complexity rating. Exploitation can occur remotely without authentication or user interaction, potentially leading to data exposure, content modification, or service disruption. Affected versions range from Next.js 13.4 up to, but not including, 15.5.24 and 16.3.3.
Vercel, the company behind Next.js, has addressed this issue by releasing patches in Next.js versions 15.5.24 and 16.3.3. For affected applications hosted on Windows, there is currently no workaround, making an immediate upgrade the only recommended mitigation. Developers are urged to update their Next.js installations to the patched versions to protect their applications.
The second critical advisory, GHSA-2xp9-vwfh-vxw4, targets Next.js Image Optimization API deployments that process AVIF image files. This vulnerability stems from an issue within the libheif library, a dependency used by the Sharp image-processing package, which Next.js relies on for image manipulation. An attacker could potentially upload a specially crafted, malicious AVIF image to an endpoint that uses the vulnerable image optimization feature. If processed by the affected libheif component, this malicious image could trigger remote code execution on the server.
This AVIF-related flaw has a CVSS v4 score of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, signifying a critical impact across confidentiality, integrity, and availability. The vulnerability affects Next.js versions from 10.0.0 up to, but not including, 15.5.24 and 16.3.3. Similar to the path traversal flaw, this issue has also been resolved in Next.js versions 15.5.24 and 16.3.3.
As a temporary protective measure, Next.js had disabled AVIF optimization in affected versions until the dependency fix could be propagated. However, organizations should not solely rely on this temporary measure. Administrators are advised to update their deployed Next.js applications, rebuild production containers, refresh dependency lockfiles, and verify that their active workloads are running the patched releases. Security teams should also conduct thorough reviews of public image upload paths, the exposure of the Next.js Image Optimization API, and logs for any suspicious activity related to AVIF processing or traversal patterns on Windows-hosted instances.
These critical vulnerabilities were reported by researchers evolutionstorm and B0RI. The simultaneous disclosure of two severe RCE flaws highlights the ongoing challenges in securing complex web application frameworks and their dependencies. Developers and security professionals must remain vigilant, promptly apply security updates, and implement robust security practices to defend against sophisticated threats.