Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patched two critical unauthenticated remote code execution flaws in Next.js: a Windows path traversal tracked as CVE-2026-75604 with a CVSS score of 9.0, and a heap buffer overflow in libheif reached through AVIF image optimization...