As reported by The Hacker News, Vercel has patched two critical-severity unauthenticated remote code execution vulnerabilities in the Next.js framework — one rooted in the libheif image processing library and another in a Windows-specific path traversal flaw. Both deserve immediate attention from any organization running self-hosted Next.js infrastructure, but they carry distinctly different risk profiles that defenders need to understand separately.
Vulnerability Summary
| Identifier | CVSS | Severity | Affected Versions | Patched Versions | Active Exploitation |
|---|---|---|---|---|---|
| CVE-2026-75604 (Windows path traversal) | 9.0 | Critical | Next.js 13.4–15.5.23; 16.0–16.3.2 (Windows-hosted, Pages Router and App Router without Cache Components) | 15.5.24 (Maintenance LTS), 16.3.3 (Active LTS) | Not confirmed |
| GHSA-2xp9-vwfh-vxw4 (AVIF/libheif heap overflow) | 9.5 | Critical | Next.js 10.0.0–15.5.23; 16.0–16.3.2 (all platforms); libheif ≤ v1.23.1 | 15.5.24, 16.3.3 | Not confirmed; full PoC published |
The AVIF Flaw Is the Broader Threat
While the Windows path traversal carries a slightly lower CVSS, the AVIF/libheif vulnerability is the one that should keep security teams up at night. It affects all platforms — not just Windows — and a full Python proof-of-concept has been publicly released alongside the libheif disclosure. The root cause is a heap buffer overflow in libheif's image scaling code, triggered by a crafted AVIF file with nested identity-derivation and auxiliary item references that create conflicting Alpha plane bit depths. The scaler allocates a buffer for 8-bit samples but writes 16-bit values, corrupting roughly 16 KB past the allocation boundary.
This matters because Next.js's built-in image optimization component is often exposed to unauthenticated traffic. Any application that accepts user-uploaded images or processes externally sourced AVIF files is a viable attack surface. The fact that a working PoC exists means opportunistic exploitation is a near-certainty, even if it hasn't been observed yet.
The AVIF flaw is a supply-chain vulnerability in the truest sense — Next.js depends on sharp, sharp depends on libheif, and the weakest link in that chain produces RCE in the framework at the top. Organizations that never even realized their Next.js app parses AVIF files are now exposed.
The Windows Path Traversal: Narrower but Unpatchable Without Upgrade
CVE-2026-75604 is more contained in scope — it only affects Windows-hosted deployments using the Pages Router or App Router without Cache Components. Linux and macOS are unaffected, and Vercel-hosted applications are protected on both fronts. However, Vercel explicitly noted that there is no workaround for affected Windows-hosted applications. This is a patch-or-remain-vulnerable scenario with no interim mitigation, which is unusual and concerning.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch Next.js immediately: Run
npm install next@15.5.24ornpm install next@16.3.3depending on your release line. Do not delay for maintenance windows. - Audit your image processing pipeline: If your application processes user-supplied images, treat the AVIF vector as actively exploitable. Consider temporarily disabling AVIF format support or restricting image sources to trusted domains until patching is verified.
- Verify libheif versions in containers: If you ship Docker images, confirm that the underlying libheif package is updated beyond v1.23.1. Patching Next.js does not guarantee the native dependency is refreshed in a cached image layer.
- Inventory Windows-hosted Next.js deployments: These are your highest-priority patch targets since no workaround exists. If immediate patching isn't feasible, consider routing traffic through a WAF with path traversal filtering as a partial compensating control.
- Deploy detection rules: Monitor for abnormally large AVIF file uploads, unexpected child process spawning from Node.js workers, and anomalous file system access patterns on Windows hosts. The PoC's public availability means detection engineering is worthwhile.
- Lock down image optimization endpoints: Restrict the Next.js image optimizer to a allowlist of permitted source domains if business requirements permit.
Broader Implications
This release underscores a persistent blind spot in JavaScript ecosystem security: framework-level RCE caused by native C library dependencies two or three layers deep in the supply chain. Most Next.js users have no visibility into libheif, and few would list it as a dependency in their SBOM. Security teams should use this incident as justification to expand dependency scanning beyond npm packages to include native bindings and transitive C library dependencies. Until the JavaScript ecosystem matures its handling of native dependency versioning, these supply-chain RCE chains will continue to surface.
