Critical Next.js RCE Flaws: What Teams Running Next.js Must Do

Vercel has patched two critical, unauthenticated remote-code-execution (RCE) vulnerabilities in Next.js — the framework behind a huge slice of the modern web (tens of millions of weekly downloads). Both let an attacker run code on a vulnerable server without logging in. If your team self-hosts a Next.js app, this is a drop-everything-and-patch situation.

Flaw 1 — Windows path traversal (CVE-2026-75604, CVSS 9.0)

A path-traversal vulnerability affecting Next.js apps that run on a Windows filesystem (using the Pages Router and App Router without Cache Components). An unauthenticated attacker can traverse the filesystem to reach and execute code.

• Affected: Windows-hosted servers only
• Not affected: Linux and macOS deployments
• Fix: upgrade to a patched release — there is no known workaround for affected Windows hosts

Flaw 2 — AVIF image RCE (GHSA-2xp9-vwfh-vxw4)

The nastier one for most teams. It originates in the upstream libheif dependency and triggers when Next.js Image Optimization processes a maliciously crafted AVIF file. Feed the optimizer a bad image and you get unauthenticated RCE.

• Affected: Next.js 10.0.0 up to (but not including) 15.5.24, and releases before 16.3.3
• Trigger: Image Optimization enabled and processing attacker-supplied AVIF input
• Risk multiplier: apps that optimize remote images from arbitrary hosts — an attacker can point the /_next/image endpoint at a crafted AVIF

Who needs to do what

Remediation checklist

1. Upgrade Next.js to 15.5.24 or 16.3.3. This closes both holes. (If you're on the 14.x line, note the fix ships in 15/16 — plan the major upgrade, or apply the mitigations below in the meantime.)
2. Lock down image optimization. In next.config, restrict images.remotePatterns to only the hosts you actually serve images from, instead of a wildcard — this shrinks the AVIF attack surface dramatically.
3. If you can't patch immediately and you self-host on Windows, treat the box as high-risk: put it behind a WAF, and prioritize the upgrade.
4. Confirm your host. If you deploy on Vercel, verify in their August 2026 security notice — you're covered — but still upgrade your dependency to stay off the affected line.

The takeaway

Two unauthenticated RCEs at CVSS 9.0+ in a framework this widely used is about as serious as web-app security gets. Vercel-hosted apps are covered; self-hosted apps — especially on Windows or optimizing untrusted images — should patch today. Upgrade to 15.5.24 / 16.3.3, tighten remotePatterns, and move on with your day.

See also our coverage of the industry warning on AI-driven cyberattacks. Details from published advisories; verify specifics against the official Next.js/Vercel security release for your version.