Next.js — Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE (CVE-2026-75604)

Publication date: August 27, 2026
Category: Vulnerability / Web Security

Introduction

Vercel has rolled out critical security updates for the Next.js web framework to address two severe vulnerabilities that allow unauthenticated remote code execution (RCE). The first vector impacts servers operating on Windows file systems through a path traversal flaw tracked as CVE-2026-75604, while the second involves a heap-based buffer overflow within the underlying libheif image processing library when parsing crafted AVIF image files. The vulnerabilities were responsibly disclosed by security researchers evolutionstorm, B0RI, rootxharsh, KarimPwnz, and the Hacktron team, prompting Vercel to accelerate its scheduled monthly patch cycle.

What is Next.js and the Media Processing Subsystem? (General Analysis)

Next.js is a prominent React-based web framework used extensively in enterprise environments for server-side rendering (SSR) and static site generation (SSG). To optimize visual performance, Next.js incorporates built-in image optimization powered by the sharp package, which in turn relies on the C library libheif to decode HEIF and AVIF image formats.

The criticality of these components lies in their handling of external, untrusted inputs (user-uploaded or linked image files). When media endpoints lack rigorous boundary validation, low-level memory corruption bugs inside underlying parsing libraries directly expose the Node.js runtime environment to systemic compromise.

Estimated technical metrics for the discussed vulnerabilities include:

  • CVE-2026-75604 (Windows Path Traversal):

    • Estimated CVSS v3.1 Score: 9.0 (Critical)
    • Estimated CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    • Estimated CWE Classification: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal)
    • Data Nature: Reasoned estimate (no NVD record published at the time of reporting).

  • AVIF Image Processing Flaw (GHSA-2xp9-vwfh-vxw4 / GHSA-g89c-p67h-r497):

    • Official Reported CVSS v4.0 Score: 9.5 (Critical)
    • Estimated CVSS Vector: CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Estimated CWE Classification: CWE-122 (Heap-based Buffer Overflow)
    • Data Nature: Data sourced from vendor and third-party security advisories; estimated memory overflow vector.

How Does It Work? (Technical Analysis)

The exploitation mechanisms involve two distinct vectors resulting in remote code execution:

  • Windows Path Traversal Flow (CVE-2026-75604):

    • Entry Vector: Next.js applications configured to use both the Pages Router and App Router (without Cache Components) running on Windows filesystems handle normalized file paths insecurely.
    • Execution Mechanism: An unauthenticated attacker sends malformed HTTP requests containing directory traversal sequences (e.g., ..\..\), enabling access or manipulation of resources outside the designated web root directory. Depending on the application structure and execution context, this can lead to local file inclusion or arbitrary execution. Linux and macOS deployments remain unaffected due to distinct OS path semantics.

  • AVIF Heap Overflow Flow (libheif):

    • Entry Vector: An attacker supplies a specially crafted AVIF image file featuring nested identity-derivation and auxiliary item references.
    • Corruption Mechanism: The malicious file forces libheif to build a decoded image containing two Alpha plane entries at disparate bit depths (one 8-bit entry and one 16-bit entry).
    • Memory Overwrite: The scaling component allocates a destination buffer sized strictly for the first 8-bit entry, but then proceeds to write 16-bit sample values from the second entry into that same buffer. This triggers a heap-based buffer overflow, overwriting approximately 16,384 bytes past the allocation boundary, corrupting heap management metadata, and enabling arbitrary code execution within the host process.

Affected Systems / Environments

The impact spans multiple version branches of Next.js, dependent on operating system configurations and feature usage:

CVE / IdentifierCWE ClassificationImpactCVSSVector (Summary)
CVE-2026-75604CWE-22 (Path Traversal)Unauthenticated RCE (Windows only)9.0 (Est.)Network / No Privileges / High Complexity
GHSA-2xp9-vwfh-vxw4CWE-122 (Heap Overflow)Unauthenticated RCE (AVIF Optimization)9.5Network / No Privileges / Low Complexity
  • Affected versions for Windows flaw: Next.js versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2 (restricted to Windows-hosted environments).
  • Affected versions for AVIF flaw: Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2, provided that image/avif is explicitly configured in next.config.js.

Mitigation and Detection

Remediation

  • Immediate Upgrading: Upgrade Next.js to patched maintenance releases 15.5.24 (Maintenance LTS) or 16.3.3 (Active LTS).
  • Windows Deployment Mitigation: Because no known workaround exists for Windows-hosted applications, immediate patching is mandatory.
  • Temporary AVIF Disabling: Patched Next.js releases completely disable AVIF optimization until upstream fixes propagate formally from libheif (v1.23.2).

Detection

  • Dependency Auditing: Audit build logs and installed Node.js package versions to detect vulnerable Next.js installations and outdated image processing libraries.
  • Web Log Analysis: Review access logs for anomalous HTTP requests incorporating directory traversal sequences (..\\ or URL-encoded equivalents) targeted at Windows-hosted endpoints.

Threat Intelligence Warning: Vulnerabilities combining memory corruption in graphic processing libraries with platform-specific path logic flaws significantly lower the barrier for automated exploitation campaigns driven by AI-assisted research tools.

Wrapping Up

The critical vulnerabilities discovered in Next.js and its media processing dependencies (libheif), combined with the Windows path traversal flaw, highlight the systemic fragility inherent in modern software supply chains. The capability to achieve unauthenticated remote code execution mandates rapid response from engineering teams, prioritizing dependency updates and hardening operational environments running on Windows.

References