TL;DR
- what: Vercel patched two critical unauthenticated RCE vulnerabilities in Next.js on August 25, 2026, one a Windows path traversal and one a heap buffer overflow reached through AVIF image parsing.
Vercel released patches on August 25, 2026 for two critical Next.js vulnerabilities that both end in unauthenticated remote code execution. The first is a path traversal, CVE-2026-75604, rated CVSS 9.0, that only affects servers running on a Windows filesystem. The second is a heap buffer overflow in the libheif C library, rated CVSS v4 9.5, reachable whenever Next.js optimizes an attacker-supplied AVIF image. The fixed builds are Next.js 15.5.24 on the Maintenance LTS line and 16.3.3 on the Active LTS line. Applications hosted on Vercel are protected from both and need no upgrade.
The Windows flaw has no mitigation short of upgrading
CVE-2026-75604 hits Next.js applications that use both the Pages Router and the App Router without Cache Components, when the underlying server uses a Windows filesystem. Linux and macOS deployments are not affected. The vulnerable range is Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2, which covers more than two years of shipped releases, so a large share of self-hosted Windows estates is in scope by default.
Vercel's advisory is blunt about the options: "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." The company did not disclose the attack mechanism, which limits what defenders can do at the WAF or reverse proxy layer. Without a published request pattern, there is no reliable signature to write. Vercel's changelog credited researchers evolutionstorm and B0RI with the disclosure.
⚠️ Windows self-hosters have one option — There is no configuration change, no proxy rule, and no published request signature that blocks CVE-2026-75604. Upgrading to Next.js 15.5.24 or 16.3.3 is the only control. Treat Windows-hosted Next.js as actively vulnerable until the package version is confirmed on every node.
The AVIF bug sits three layers below your code
The second issue is not a Next.js bug at all in origin. Next.js uses the sharp package for image optimization, sharp uses the libheif C library to parse AVIF files, and libheif carries a heap buffer overflow in its image scaling code. Every libheif version through v1.23.1 is affected. The Next.js advisory, GHSA-2xp9-vwfh-vxw4, covers Next.js 10.0.0 through 15.5.23 and every 16.x release through 16.3.2. The upstream advisory is GHSA-g89c-p67h-r497.
The mechanism is specific and it is worth understanding, because it explains why the write is so large:
- A crafted AVIF file carries nested identity-derivation and auxiliary item references.
- libheif builds a decoded image that ends up with two Alpha plane entries at different bit depths.
- The scaler sizes the destination buffer for the first entry, which is 8-bit.
- It then writes 16-bit sample values from the second entry into that same buffer.
- The result is roughly 16,384 bytes written past the allocation boundary, which is a large and highly controllable heap corruption primitive.
Researchers rootxharsh, credited as Finder, and KarimPwnz, credited as Coordinator, published a full Python proof of concept alongside the libheif disclosure that reproduces the corruption under an address sanitizer build. Vercel's changelog attributed the disclosure to the Hacktron team. The researchers stated in the libheif advisory that "we were able to get RCE using this on multiple applications." The public proof of concept demonstrates the out of bounds write; the remote code execution claim has not been independently corroborated.
Not every deployment is exposed to the AVIF path
Next.js enables AVIF optimization only when a site explicitly adds image/avif to the formats array in next.config.js. If that entry is absent, the AVIF parser is never reached and the deployment is not exposed to this flaw. Grep your configuration before you panic, and grep it again before you assume you are clear, because the setting is commonly copied in from performance tuning guides.
The patched Next.js releases take a heavier approach: they turn AVIF optimization off entirely until the upstream fix propagates. That is a functional regression for teams that rely on AVIF for page weight, and it is deliberate, because there is nothing to propagate yet. The Hacker News confirmed on August 27, 2026, via the libheif GitHub releases page, that v1.23.2 had not been published. The C library at the bottom of this chain remains unpatched, which means anything else in your environment that links libheif, image pipelines, thumbnailers, document converters, media servers, is still carrying the same bug with no vendor fix available.
Who can stand down — Deployments on Vercel are covered for both issues. Self-hosted deployments on Linux or macOS that do not list image/avif in the formats config are exposed to neither. Everyone else needs the upgrade.
What to do this week
- Inventory Next.js versions across all self-hosted deployments, including internal tools and staging environments that rarely get patched.
- Upgrade with npm install next@15.5.24 for the 15.5 line, or npm install next@16.3.3 for the 16.3 line.
- Prioritize any node on a Windows filesystem first, since that path has no compensating control.
- Search every next.config.js for image/avif in the formats array and treat a hit as exposed until patched.
- Inventory other software in the environment that links libheif, since no upstream fix has shipped as of August 27, 2026.
- Confirm July patch levels are not treated as current: teams already on 16.2.11 or 15.5.21 still need the August release.
A monthly cadence that is already being outpaced
This is the second release under Vercel's formal monthly security program, announced on July 13, 2026. The company had scheduled the August drop for August 26 but moved it forward by one day. "Earlier today, we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies," wrote Josh Story, Karim Rahal, and Sebastian Silbermann in Vercel's security blog post.
The program announcement named the driver directly. "The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery," said Andrew Imm and Josh Story. The first scheduled release on July 21 already carried nine vulnerabilities across Next.js 16.2.11 and 15.5.21, spanning denial of service, server side request forgery, and middleware bypass. Two releases into a monthly cadence, one of them has already had to move for an out of band critical. Plan patch windows on the assumption that this pace holds.
Track record raises the stakes on patch speed
Next.js has been through a string of critical disclosures. A March 2025 middleware bypass let unauthenticated attackers skip authorization checks in self-hosted deployments. The React2Shell deserialization flaw in React Server Components, disclosed in December 2025, carried a CVSS score of 10.0 and was exploited in the wild within hours of public disclosure. That last data point is the one to weigh when scheduling this upgrade: for this framework, the gap between advisory and exploitation has already been measured in hours, not weeks.
No exploitation of either August vulnerability had been reported as of August 27, 2026. The attack mechanism for the Windows flaw remains undisclosed, and the RCE claim on the AVIF bug rests on the researchers' own statement rather than public verification. The Hacker News reached out to Vercel for comment and had not received a response by publication. Patch on the versions, not on the exploit evidence.
Originally published on RedEye Threat Intelligence.
Top comments (0)