Vercel has issued an urgent call to action for developers using the Next.js web framework, releasing critical security patches for two severe vulnerabilities. Both flaws enable unauthenticated remote code execution (RCE), posing a significant threat to affected applications. These vulnerabilities include a critical heap buffer overflow exploitable via specially crafted AVIF image files and a path traversal flaw specifically impacting Next.js servers running on Windows filesystems.
The AVIF Image Optimization Vulnerability: A Heap Buffer Overflow Threat
One of the critical vulnerabilities (tracked as GHSA-2xp9-vwfh-vxw4, with a CVSS v4 score of 9.5) stems from the sharp image processing package, which Next.js utilizes for image optimization. sharp, in turn, relies on the libheif C library for parsing AVIF files. The core issue lies within libheif, where a heap buffer overflow in its image scaling code (GHSA-g89c-p67h-r497) can lead to RCE when Next.js processes a malicious AVIF image.
This flaw affects Next.js versions 10.0.0 through 15.5.23 and all 16.x releases up to 16.3.2. The attack mechanism involves a crafted AVIF file containing nested identity-derivation and auxiliary item references. This tricks libheif into building a decoded image with two Alpha plane entries at different bit depths. Consequently, the scaler allocates a buffer for an 8-bit Alpha entry but then writes 16-bit sample values from the second entry into the same buffer, causing an out-of-bounds write of approximately 16,384 bytes.
Researchers rootxharsh (Finder) and KarimPwnz (Coordinator) were credited with disclosing the underlying libheif vulnerability and even released a Python proof-of-concept. Vercel’s changelog also attributed the disclosure to the Hacktron team. It’s crucial to note that Next.js only enables AVIF optimization if image/avif is explicitly configured in next.config.js. Deployments without this specific configuration are not exposed to this particular flaw. The latest Next.js patches temporarily disable AVIF optimization entirely until an upstream fix is fully propagated from libheif.
Windows Path Traversal: A Platform-Specific RCE Risk
The second critical vulnerability, a Windows path traversal flaw (CVE-2026-75604, CVSS score: 9.0), targets Next.js applications deployed on Windows filesystems. This vulnerability affects applications using both the Pages Router and App Router without Cache Components. Importantly, Linux and macOS deployments remain unaffected.
Vercel’s advisory explicitly states, “There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.” This underscores the severity and the lack of alternative mitigations for Windows-based deployments. The vulnerability impacts Next.js versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2. Researchers evolutionstorm and B0RI were credited for the responsible disclosure of this Windows-specific flaw.
Immediate Action Required: Patching and Vercel’s Security Cadence
Vercel has released the necessary fixes in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS) on August 25, 2026. Users are strongly advised to upgrade their installations immediately:
- For the 15.5 line:
npm install next@15.5.24 - For the 16.3 line:
npm install next@16.3.3
Applications hosted directly on Vercel are automatically protected from both vulnerabilities and do not require manual upgrades. This swift action highlights Vercel’s commitment to security, especially as this August release marks the second under their formal monthly security program, initiated in July 2026. The program was fast-tracked by a day due to the discovery of an additional critical-severity vulnerability in an upstream dependency, demonstrating Vercel’s proactive approach.
The Evolving Threat Landscape for Web Frameworks
These recent disclosures come amidst a rapidly evolving cybersecurity landscape, where, as Vercel noted, “The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery.” Next.js, a popular framework, has unfortunately been a frequent target, experiencing a series of critical security incidents over the past two years. Notable past flaws include a critical middleware bypass in March 2025 and the React2Shell deserialization flaw in React Server Components in December 2025.
Even users who applied the July 21 patches (Next.js 16.2.11 and 15.5.21), which addressed nine vulnerabilities including DoS, SSRF, and middleware bypasses, still require this latest August upgrade. This continuous stream of critical vulnerabilities emphasizes the ongoing need for vigilance and prompt patching in modern web development.
Conclusion
The discovery and patching of these two critical RCE vulnerabilities in Next.js serve as a stark reminder of the persistent security challenges in web development. Developers are urged to prioritize immediate upgrades, especially those running Next.js applications on Windows filesystems or utilizing AVIF image optimization. Staying updated with the latest security releases is paramount to safeguarding applications against sophisticated threats.
For more details, visit our website.
Source: Link
Leave a comment