Next.js patches two critical flaws allowing unauthenticated remote code execution
Vercel issued emergency patches on August 25 for two critical vulnerabilities in Next.js that permit unauthenticated remote code execution, one triggered by maliciously crafted AVIF images and the other via a Windows path traversal flaw.
Source: The Hacker News · August 27, 2026 at 11:01 PM · AI-assisted report
Single-sourceKUALA LUMPUR, 28 AUGUST 2026 —
Vercel issued emergency patches on August 25 for two critical vulnerabilities in Next.js that permit unauthenticated remote code execution, one triggered by maliciously crafted AVIF images and the other via a Windows path traversal flaw.
Market Impact
A heap buffer overflow in the libheif image library can be weaponised when Next.js processes an attacker-controlled AVIF file, enabling code execution on servers that enable AVIF optimisation, according to the libheif advisory. The underlying flaw, GHSA-g89c-p67h-r497, carries a CVSS v4 score of 9.5 and affects all libheif versions up to v1.23.1.
Vercel’s patched releases disable AVIF optimisation until the upstream fix is released; the Hacker News noted on August 27 that v1.23.2 had not yet been published.
A separate critical path traversal issue tracked as CVE-2026-75604 (CVSS 9.0) affects Next.js applications using both Pages Router and App Router without Cache Components on Windows filesystems. Linux and macOS deployments are unaffected. Vercel said no workaround exists and urged immediate upgrades for Windows-hosted instances.
The fixes are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published ahead of the scheduled August 26 release after Vercel discovered an additional critical-severity flaw in an upstream dependency. Users can upgrade via npm install next@15.5.24 or next@16.3.3; applications hosted on Vercel are already protected and require no action, the company said.
Affected versions span Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2 for both flaws. The Windows vulnerability was credited to evolutionstorm and B0RI; the AVIF flaw disclosure lists rootxharsh as Finder and KarimPwnz as Coordinator, though Vercel’s changelog attributed the disclosure to the Hacktron team. No exploitation of either flaw has been reported as of August 27.
The August release is the second under Vercel’s monthly security cadence, introduced in July 2026 to address rising LLM-assisted vulnerability discovery. The July 21 patch covered nine issues including denial-of-service, server-side request forgery, and middleware bypass flaws. Users still on those July fixes must upgrade to the August releases.
Related: Vercel