Vercel has released security updates for two critical vulnerabilities in Next.js that could allow unauthenticated attackers to achieve remote code execution on vulnerable applications.
The flaws were addressed in the Next.js August 2026 security release, with patched versions 15.5.24 and 16.3.3 released on August 25.
The first vulnerability, tracked as GHSA-2xp9-vwfh-vxw4, affects Next.js image optimization when processing AVIF images and carries a CVSS score of 9.5. The second, tracked as CVE-2026-75604, affects certain Windows-hosted Next.js applications and has been assigned a CVSS score of 9.0.
Both vulnerabilities can be exploited remotely without authentication when the necessary application and deployment conditions are present.
Next.js AVIF Image Optimization RCE
The more broadly applicable issue is tracked as GHSA-2xp9-vwfh-vxw4 and currently does not have an assigned CVE identifier.
The vulnerability originates in the underlying libheif library used by sharp, which Next.js relies on for image optimization. A vulnerability in the image-processing chain can result in remote code execution when a malicious AVIF image is processed by the Next.js Image Optimization API.
An attacker therefore does not require an authenticated account, although exploitation requires an application configuration that allows attacker-controlled AVIF content to reach the vulnerable image optimization functionality.
The vulnerability affects:
- Next.js 10.0.0 through versions earlier than 15.5.24
- Next.js 16.x versions earlier than 16.3.3
The issue is rated Critical with a CVSS v4 score of 9.5.
Next.js has temporarily disabled optimization of AVIF images in the patched releases while the underlying dependency fix propagates through the relevant image-processing dependencies.
Successful exploitation could allow an attacker to execute code in the context of the vulnerable Next.js application, potentially leading to application takeover, access to sensitive data, further compromise of connected services, or disruption of the affected server.
CVE-2026-75604 Affects Windows-Hosted Next.js Servers
The second vulnerability, tracked as CVE-2026-75604 and GHSA-p293-qw3h-jr36, can also lead to unauthenticated remote code execution.
The flaw is associated with improper pathname handling and is classified as CWE-22 – Improper Limitation of a Pathname to a Restricted Directory, commonly referred to as path traversal.
Unlike the AVIF vulnerability, CVE-2026-75604 is specific to Next.js applications hosted on systems using a Windows filesystem.
Affected applications use both the Pages Router and App Router without Cache Components.
The affected versions are:
- Next.js 13.4 through versions earlier than 15.5.24
- Next.js 16.0 through versions earlier than 16.3.3
The vulnerability carries a CVSS v3.1 score of 9.0 and can be exploited remotely without authentication or user interaction.
Next.js states that there is no known workaround for affected Windows-hosted applications, making upgrading the primary remediation.
Linux and macOS deployments are not affected by this specific Windows filesystem vulnerability, although they may still be exposed to the separate AVIF image optimization issue.
Public Exploit Code Increases Remediation Urgency
Public proof-of-concept exploit code targeting CVE-2026-75604 has already become available following disclosure of the vulnerability.
The published exploit demonstrates remote command execution against a deliberately vulnerable Windows-hosted Next.js environment when the required application configuration is present.
The availability of public exploit material reduces the effort required for attackers to study and reproduce the vulnerability and increases the importance of rapidly identifying exposed Next.js deployments.
Cloudflare also issued an emergency WAF release on August 26, updating an existing Next.js remote code execution rule to specifically identify CVE-2026-75604 and introducing a new blocking rule designed to detect attempts to exploit the AVIF Image Optimizer vulnerability.
While WAF protections can provide an additional defensive layer, they should not be considered a replacement for upgrading vulnerable Next.js installations.
Affected and Patched Next.js Versions
| Vulnerability | Affected versions | Patched versions |
| GHSA-2xp9-vwfh-vxw4 – AVIF Image Optimization RCE | >=10.0.0 <15.5.24 and <16.3.3 | 15.5.24 / 16.3.3 |
| CVE-2026-75604 – Windows-hosted RCE | >=13.4 <15.5.24 and >=16.0 <16.3.3 | 15.5.24 / 16.3.3 |
Organizations operating self-hosted Next.js environments should prioritize identifying installations that fall within these version ranges.
Recommended Actions
Organizations using Next.js should:
- Upgrade immediately to Next.js 15.5.24, 16.3.3, or a later supported release.
- Identify externally accessible and self-hosted Next.js applications and confirm their deployed versions.
- Prioritize Windows-hosted Next.js environments, particularly applications using both the Pages Router and App Router without Cache Components.
- Determine whether applications use Next.js Image Optimization and whether attacker-controlled or externally hosted AVIF images can reach the image-processing pipeline.
- Redeploy applications after updating dependencies to ensure production workloads are running the patched Next.js release.
- Review access and application logs for unusual requests to Next.js image optimization endpoints, including suspicious activity involving /_next/image.
- Review Windows-hosted environments for suspicious application behavior or unexpected command execution if vulnerable versions were previously Internet-accessible.
- Apply available WAF protections as an additional mitigation layer while upgrades are being completed.
Organizations should not rely solely on the absence of vulnerability scanner findings. Application dependencies and deployment configurations should also be reviewed directly to establish whether vulnerable Next.js versions are present.
Stay Safe. Stay Secure.
OP Innovate Research Team
