Skip to content
Breaking
Mitsubishi Triton Single Cab Now Available With Automatic Transmission, Priced at RM107,980Zetrix AI plunges 50% in heavy trade, hits limit-downJakarta stocks rise as political risks ease, BI leadership takes shapeTNB and Petronas launch RM10 billion green energy partnershipSaravanan admits to taking almost RM1.1 million in bribesKak Kay’s personality framework helps couples decode relationship conflictsNepal floods trap 55 Malaysians, including two senior rescue officersSaravanan charged with receiving RM1.097m bribe, foreign worker quota application approvedJakarta protests force road closures, leaving Malaysians strandedNepal police release names of 23 missing Malaysians after floodsMerdeka Weekend, Sorted: Party, Chill & Everything In BetweenViu Original 'Cela' hits No 1 on Viu charts in first weekWhat to expect on Bursa Malaysia this FridaySaravanan arrives at court, faces corruption chargesCarbon market framework to unlock RM560 million a year in climate financeU.S.-Canada trade talks collapse as Trump prepares 50% tariffs on autos and steelIran war at six months leaves Strait of Hormuz disrupted and U.S. facing strategic setbackMistrust threatens Bersatu-PH pact for Melaka pollsKennedy Center board’s Trump renaming rush questioned by US judgeUN condemns US labeling Palestine Action as extremist groupMitsubishi Triton Single Cab Now Available With Automatic Transmission, Priced at RM107,980Zetrix AI plunges 50% in heavy trade, hits limit-downJakarta stocks rise as political risks ease, BI leadership takes shapeTNB and Petronas launch RM10 billion green energy partnershipSaravanan admits to taking almost RM1.1 million in bribesKak Kay’s personality framework helps couples decode relationship conflictsNepal floods trap 55 Malaysians, including two senior rescue officersSaravanan charged with receiving RM1.097m bribe, foreign worker quota application approvedJakarta protests force road closures, leaving Malaysians strandedNepal police release names of 23 missing Malaysians after floodsMerdeka Weekend, Sorted: Party, Chill & Everything In BetweenViu Original 'Cela' hits No 1 on Viu charts in first weekWhat to expect on Bursa Malaysia this FridaySaravanan arrives at court, faces corruption chargesCarbon market framework to unlock RM560 million a year in climate financeU.S.-Canada trade talks collapse as Trump prepares 50% tariffs on autos and steelIran war at six months leaves Strait of Hormuz disrupted and U.S. facing strategic setbackMistrust threatens Bersatu-PH pact for Melaka pollsKennedy Center board’s Trump renaming rush questioned by US judgeUN condemns US labeling Palestine Action as extremist group
AI Edge

Next.js patches two critical flaws allowing unauthenticated remote code execution

Vercel issued emergency patches on August 25 for two critical vulnerabilities in Next.js that permit unauthenticated remote code execution, one triggered by maliciously crafted AVIF images and the other via a Windows path traversal flaw.

Source: The Hacker News · August 27, 2026 at 11:01 PM · AI-assisted report

Single-source
Next.js patches two critical flaws allowing unauthenticated remote code execution
Photo: Sacamol / CC BY-SA 3.0

KUALA LUMPUR, 28 AUGUST 2026 —

Listen to this article

DomainFork Audio · read aloud

Share

Vercel issued emergency patches on August 25 for two critical vulnerabilities in Next.js that permit unauthenticated remote code execution, one triggered by maliciously crafted AVIF images and the other via a Windows path traversal flaw.

Market Impact

A heap buffer overflow in the libheif image library can be weaponised when Next.js processes an attacker-controlled AVIF file, enabling code execution on servers that enable AVIF optimisation, according to the libheif advisory. The underlying flaw, GHSA-g89c-p67h-r497, carries a CVSS v4 score of 9.5 and affects all libheif versions up to v1.23.1.

Vercel’s patched releases disable AVIF optimisation until the upstream fix is released; the Hacker News noted on August 27 that v1.23.2 had not yet been published.

A separate critical path traversal issue tracked as CVE-2026-75604 (CVSS 9.0) affects Next.js applications using both Pages Router and App Router without Cache Components on Windows filesystems. Linux and macOS deployments are unaffected. Vercel said no workaround exists and urged immediate upgrades for Windows-hosted instances.

The fixes are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published ahead of the scheduled August 26 release after Vercel discovered an additional critical-severity flaw in an upstream dependency. Users can upgrade via npm install next@15.5.24 or next@16.3.3; applications hosted on Vercel are already protected and require no action, the company said.

Affected versions span Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2 for both flaws. The Windows vulnerability was credited to evolutionstorm and B0RI; the AVIF flaw disclosure lists rootxharsh as Finder and KarimPwnz as Coordinator, though Vercel’s changelog attributed the disclosure to the Hacktron team. No exploitation of either flaw has been reported as of August 27.

The August release is the second under Vercel’s monthly security cadence, introduced in July 2026 to address rising LLM-assisted vulnerability discovery. The July 21 patch covered nine issues including denial-of-service, server-side request forgery, and middleware bypass flaws. Users still on those July fixes must upgrade to the August releases.

Related: Vercel

Reporting based on The Hacker News. Figures and claims are subject to revision as the story develops. DomainFork publishes editorial context, not investment advice — see our editorial standards.