Full Report
Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal, tracked as CVE-2026-75604&
Analysis Summary
# Vulnerability: Next.js Unauthenticated RCE (AVIF & Windows Path Traversal)
## CVE Details
**Vulnerability 1: Windows Path Traversal**
- **CVE ID:** CVE-2026-75604
- **CVSS Score:** 9.0 (Critical)
- **CWE:** Path Traversal (leading to RCE)
**Vulnerability 2: AVIF Image Optimization Flaw**
- **CVE ID:** GHSA-2xp9-vwfh-vxw4 (Upstream libheif: GHSA-g89c-p67h-r497)
- **CVSS Score:** 9.5 (Critical)
- **CWE:** CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products:** Next.js Web Framework
- **Versions:**
- **Windows Flaw:** 13.4 through 15.5.23 and 16.0 through 16.3.2.
- **AVIF Flaw:** 10.0.0 through 15.5.23 and 16.0 through 16.3.2.
- **Configurations:**
- **Windows Flaw:** Servers using a Windows filesystem utilizing Pages Router and App Router without Cache Components.
- **AVIF Flaw:** Applications where `image/avif` is explicitly added to the `formats` configuration in `next.config.js`.
## Vulnerability Description
- **CVE-2026-75604:** A path traversal flaw specifically affecting Windows-based host environments. The vulnerability allows unauthenticated attackers to achieve remote code execution (RCE). The specific mechanism was not publicly disclosed to prevent immediate mass exploitation.
- **AVIF Flaw:** Next.js uses the `sharp` library, which relies on `libheif` for AVIF parsing. A heap buffer overflow occurs when processing specially crafted AVIF files with nested identity-derivation. The library allocates an 8-bit buffer but writes 16-bit values, resulting in an out-of-bounds write of approximately 16,384 bytes.
## Exploitation
- **Status:** PoC available (Python PoC released for the AVIF/libheif flaw; RCE claimed by researchers).
- **Complexity:** Low (Unauthenticated)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Overall:** Full system compromise via Remote Code Execution.
## Remediation
### Patches
Upgrade to the following versions immediately:
- **Next.js 15.5.24** (Maintenance LTS)
- **Next.js 16.3.3** (Active LTS)
*Note: Applications hosted directly on Vercel's platform are already protected.*
### Workarounds
- **For AVIF Flaw:** Remove `image/avif` from the `formats` array in `next.config.js`.
- **For Windows Flaw:** There is **no known workaround**. Migration to a Linux-based environment or immediate patching is required.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic from web servers, presence of unexpected `.avif` files in temp directories, or application crashes related to `libheif` or `sharp` modules.
- **Detection methods:** Monitor for directory traversal patterns (e.g., `..\` or `..%2f`) in logs targeting Windows-hosted Next.js instances. Use Address Sanitizer (ASan) builds in staging to detect heap corruption when processing user-uploaded images.
## References
- **Vercel Advisory (Windows):** hxxps://github[.]com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
- **Vercel Advisory (AVIF):** hxxps://github[.]com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
- **libheif Upstream Advisory:** hxxps://github[.]com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
- **Vercel Security Blog:** hxxps://nextjs[.]org/blog/august-2026-security-release