Next.js has released security updates for two critical vulnerabilities that can lead to unauthenticated remote code execution.
The two vulnerabilities are separate and affect different deployment scenarios. One involves AVIF image processing through an upstream libheif dependency, while the other affects Next.js applications running on Windows.
1. GHSA-2xp9-vwfh-vxw4 — Critical AVIF Processing RCE
CVE: Not assigned
CVSS v4: 9.5 — Critical
The first vulnerability is tracked by Next.js as GHSA-2xp9-vwfh-vxw4. It is not currently assigned a CVE identifier.
The vulnerability originates in the underlying libheif library, which is used by sharp, the image-processing package used by Next.js for Image Optimization. A specially crafted AVIF file can trigger a heap buffer overflow during image processing and potentially result in remote code execution.
The upstream libheif issue is tracked separately as GHSA-g89c-p67h-r497.
Who is exposed?
This is not automatically exploitable against every Next.js installation.
The attack requires the affected Image Optimization path to process AVIF input. Next.js enables AVIF optimization when the application explicitly configures image/avif in next.config.js.
That makes applications accepting or processing attacker-controlled images particularly important to assess.
What did Next.js do?
Because the upstream libheif fix had not yet propagated, the patched Next.js releases disable AVIF optimization as a protective measure.
This means upgrading may change how AVIF images are handled until the upstream dependency receives its corresponding fix.
2. CVE-2026-75604 — Windows Path Traversal RCE
CVE: CVE-2026-75604
GHSA: GHSA-p293-qw3h-jr36
CVSS: 9.0 — Critical
The second vulnerability is completely separate from the AVIF issue.
It is a path traversal vulnerability affecting Next.js applications using the Pages Router and App Router without Cache Components when the server uses a Windows filesystem.
A successful attack can result in unauthenticated remote code execution. Linux and macOS deployments are not affected by this vulnerability.
Unlike the AVIF vulnerability, there is no known workaround for affected Windows-hosted applications. Vercel recommends upgrading immediately.
Fixed Versions
Both vulnerabilities are addressed in:
- Next.js 15.5.24 — Maintenance LTS
- Next.js 16.3.3 — Active LTS
The AVIF issue affects versions beginning with 10.0.0, while the Windows vulnerability affects the relevant 13.x/15.x and 16.x ranges specified in the advisories.
For self-hosted deployments, upgrading to a patched release should be treated as the primary remediation.
What Security Teams Should Check
Organizations running Next.js should determine:
- Which Next.js version is deployed?
- Is the application self-hosted or managed by a platform such as Vercel?
- Is the application running on Windows?
- Is AVIF optimization enabled?
- Can unauthenticated users submit or influence images processed by the Image Optimization API?
- Are production workloads actually running the patched version after the upgrade?
For Vercel-hosted applications, Vercel states that its managed platform is already protected: AVIF optimization was disabled in its managed Image Optimization service, and its runtime uses Linux, eliminating exposure to the Windows-specific vulnerability.
The Key Takeaway
This release is a good reminder that a framework’s attack surface is not limited to its own source code.
The first vulnerability demonstrates how an upstream native library used for image processing can introduce an RCE condition into a web framework. The second demonstrates how the underlying operating system and application configuration can determine whether a critical framework vulnerability is exploitable.
For security teams, the right response is therefore not simply “Are we running Next.js?”
The questions should be:
Which version? Which feature? Which operating system? Which deployment model? And can an unauthenticated attacker reach the vulnerable processing path?
Those answers determine the actual exposure.
Bottom line: upgrade self-hosted Next.js deployments to 15.5.24 or 16.3.3 and validate the deployment-specific exposure of both vulnerabilities.
