Next.js Patches Critical RCE Vulnerabilities
Vercel addressed two critical flaws in Next.js enabling unauthenticated remote code execution. One involves malicious AVIF images, the other a Windows path traversal.
TL;DR
- Vercel patched two critical vulnerabilities in Next.js allowing unauthenticated RCE.
- One flaw exploits AVIF image processing; the other uses Windows path traversal.
- Organizations using Next.js on Windows systems are especially at risk.
- Immediate patching is recommended to prevent potential server compromise.
- Both issues were patched without requiring authentication to exploit.
Vercel has released urgent security updates for the popular Next.js web framework, addressing two high-severity vulnerabilities that could lead to unauthenticated remote code execution. These flaws highlight the importance of rapid patch deployment, particularly in widely used open-source frameworks.
The first vulnerability relates to how Next.js processes AVIF image files, while the second is a path traversal issue specifically impacting deployments on Windows filesystems. Both issues can be exploited without authentication, making them particularly dangerous in exposed environments.
AVIF Image Processing Flaw
- Attackers can trigger remote code execution by submitting specially crafted AVIF image files.
- No user authentication is required to exploit this vulnerability.
- The flaw resides in the way Next.js handles AVIF image optimization.
- Organizations using automatic image optimization should prioritize patching.
Windows Path Traversal Issue
- Tracked as CVE-2026-75604, this flaw affects Next.js deployments on Windows servers.
- Improper path validation allows attackers to access arbitrary files outside intended directories.
- Exploitation can lead to full remote code execution capabilities.
- Linux-based deployments are not affected by this specific path traversal issue.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.