Two critical holes in the Next.js web framework now have fixes, and both allow unauthenticated remote code execution. Vercel published the patches on August 25, with one bug triggered by specially crafted AVIF image files and the other by a path traversal that only bites servers on a Windows filesystem.
The Windows issue is CVE-2026-75604, rated 9.0 on the CVSS scale. It hits Next.js applications that combine the Pages Router and App Router without Cache Components when the server runs Windows. Linux and macOS deployments are unaffected, and there is no workaround. “You should upgrade immediately if your server is hosted on Windows,” Vercel warned.
Image optimization for Next.js is delegated to sharp, which parses AVIF input through the libheif C library. Overflowing that library’s heap while processing a malicious AVIF file yields code execution, logged as GHSA-2xp9-vwfh-vxw4 with a CVSS v4 rating of 9.5.
Patched releases are Next.js 15.5.24 and 16.3.3, covering versions 13.4 through 15.5.23 and 16.0 through 16.3.2. Apps hosted on Vercel are already protected and need no upgrade. Researchers evolutionstorm and B0RI are credited for reporting the Windows vulnerability.
