Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Summary: Vercel patched two critical unauthenticated remote code execution flaws in Next.js: a Windows path traversal tracked as CVE-2026-75604 with a CVSS score of 9.0, and a heap buffer overflow in libheif reached through AVIF image optimization (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5). Fixes shipped August 25, 2026 in Next.js 15.5.24 and 16.3.3, covering affected versions 13.4 through 15.5.23 and 16.0 through 16.3.2, and the patched releases disable AVIF optimization entirely until libheif's upstream fix lands.
What's compelling: The Windows flaw has no known workaround and Vercel's guidance is to upgrade immediately, while the AVIF flaw only reaches sites that added image/avif to their formats configuration - and as of August 27, 2026, libheif v1.23.2 had not been published, so the underlying library remains unpatched.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-75604
Related: ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026