What Happened
Vercel has shipped patches for two critical-severity vulnerabilities in the Next.js framework, both capable of unauthenticated remote code execution. One is triggered by specially crafted AVIF image files; the other is a path traversal flaw affecting server-hosted deployments on Windows.
Vulnerability #1: AVIF Heap Buffer Overflow
| Attribute | Value |
|---|---|
| Advisory | GHSA-2xp9-vwfh-vxw4 |
| CVSS Score | 9.5 (Critical) |
| Root Cause | Heap buffer overflow in libheif's image scaling code (underlying: GHSA-g89c-p67h-r497) |
| Affected Versions | Next.js 10.0.0 through 15.5.23, and all 16.x releases through 16.3.2 |
| Discovered By | rootxharsh (finder), KarimPwnz (coordinator); also flagged by the Hacktron team |
Crafted AVIF files containing nested identity-derivation references cause libheif to allocate undersized buffers, leading to 16,384-byte boundary overwrites. Researchers who reported the issue said they "were able to get RCE using this on multiple applications." The flaw only affects sites that have explicitly enabled AVIF image processing via next.config.js.
Vulnerability #2: Windows Path Traversal RCE
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-75604 |
| CVSS Score | 9.0 (Critical) |
| Affected Versions | Next.js 13.4 through 15.5.23, and 16.0 through 16.3.2 |
| Platform Impact | Windows-hosted deployments only — Linux and macOS are unaffected |
| Discovered By | evolutionstorm and B0RI |
Vercel's advisory states plainly: "there is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." Full technical details of the attack mechanism have not been disclosed.
Patched Versions
| Release Line | Patched Version |
|---|---|
| Maintenance LTS | 15.5.24 |
| Active LTS | 16.3.3 |
Remediation
# Upgrade to the patched maintenance LTS
npm install next@15.5.24
# Or upgrade to the patched active LTS
npm install next@16.3.3- Vercel-hosted applications receive automatic protection with no user action required.
- Self-hosted deployments — especially those running on Windows or with AVIF processing enabled — should upgrade immediately.
- If AVIF handling isn't required, consider disabling it in
next.config.jsas an interim mitigation while you plan the upgrade.
Context
This marks the second scheduled release under Vercel's formal monthly security disclosure program, launched in July 2026. Vercel has attributed the rising pace of vulnerability discovery in part to LLM-assisted security research, which is accelerating how quickly flaws like this are found and reported across the framework ecosystem.