www.it-connect.fr
Next.js Security Update Fixes Two Critical RCE Flaws
On August 25, 2026, Vercel released several new Next.js versions: 15.5.24 and 16.3.3. The goal? To patch two critical flaws, both of which allow unauthenticated remote code execution. Here’s the essential information you need to know about these vulnerabilities.
A single AVIF image is enough to exploit the flaw
The first flaw does not come directly from Next.js code, but from a dependency. This framework relies on the sharp package to optimize images, and sharp delegates AVIF file decoding to the C library libheif. That is where the critical security flaw lies, with a CVSS score of 9.5 out of 10 in Next.js’s advisory (and no CVE identifier at the time of writing).
A specially crafted AVIF file causes libheif to decode an image with two transparency layers instead of one, each with a different depth. The library then sizes its memory area based on the first layer, and writes the data from the second layer there, which is twice as large. Around 16 KB end up being written outside the intended area, and as you can guess, the attacker controls the contents of this overflow.
This is about Next.js, but in reality, any application relying on the libheif dependency and calling the heif_decode_image() function may be affected. In fact, the researchers note: "We were able to achieve remote code execution with this on several applications.", including Next.js.
In the case of Next.js, there is still one piece of good news: AVIF optimization is not enabled by default (it is specified by the formats parameter in next.config.js). However, if it is enabled, note that the following versions are vulnerable: 10.0.0 through 15.5.23, and for the 16.x branch up to 16.3.2.
CVE-2026-75604: a flaw on Windows servers
The second critical flaw has a CVSS score of 9.0 out of 10 and is a directory traversal issue. It also allows unauthenticated remote code execution, but three conditions must be met for the vulnerability to be exploitable:
- The application uses both the Pages Router and the App Router
- It does not use Cache Components
- The server relies on a Windows file system
In other words, this is a flaw affecting Next.js servers running on Windows, while Linux and macOS are not impacted. The vulnerable versions range from 13.4 to 15.5.23, as well as from 16.0 to 16.3.2.
What you need to do now
To protect yourself, you need to patch. This is even more true because for CVE-2026-75604, there are no workarounds other than not using the components mentioned above.
Ideally, you should install one of these versions to protect yourself from both flaws: 15.5.24 or 16.3.3. Both versions are already available via npm. As an extra check, you can also look for image/avif in the formats array in the configuration file mentioned earlier.
Finally, note that for applications hosted on Vercel, you do not need to do anything. AVIF optimization was disabled as soon as the flaw was identified, and the environment runs on Linux, which rules out the second flaw.
To learn more, here are some useful links:
- Next.js, August 2026 security update
- Vercel, August 25, 2026 changelog
- Next.js, AVIF flaw
- Next.js, CVE-2026-75604 flaw
