Summary
Vercel patched two critical vulnerabilities in Next.js that allow unauthenticated remote code execution via Windows path traversal and AVIF image optimization. Self-hosted instances must update immediately to prevent full server takeover.
Take Action:
If you self-host Next.js, update immediately to version 15.5.24 or 16.3.3 by running npm install next@15.5.24 (or npm install next@16.3.3) in your project. This is the only fix, especially for Windows servers where attackers can take over without a password. If you can't patch right away, turn off image optimization (AVIF) and where possible isolate your servers behind a firewall. Apps hosted directly on Vercel are already protected and need no action.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (1)
It’s alarming to see how vulnerabilities like the unauthenticated RCE in Next.js can expose self-hosted instances to significant risks, especially on Windows servers. The urgency of updating to the patched versions cannot be overstated, and your advice on turning off AVIF optimization as a temporary measure is practical. I’ve often implemented similar strategies to mitigate risks during critical updates. If you’re considering any enhancements to security practices in future releases, I'd be happy to explore a paid collaboration to support that effort. How do you foresee the community adapting to such vulnerabilities moving forward?