Vercel has released patches for two critical vulnerabilities in Next.js, the popular web framework in the React ecosystem. According to The Hacker News, both flaws can lead to unauthenticated remote code execution under specific deployment conditions, making them a priority for administrators to review and upgrade.
Two different attack paths, the same RCE risk
The first vulnerability is tracked as CVE-2026-75604 and carries a CVSS score of 9.0. It affects Next.js applications that use both the Pages Router and App Router, do not enable Cache Components, and run on a Windows filesystem. Linux and macOS are not affected by this issue, according to Vercel.
The notable point is that Vercel says there is no alternative workaround for affected applications running on Windows. The primary response is therefore to upgrade to a patched release rather than rely on temporary configuration changes.
The second vulnerability involves the Image Optimization API when processing attacker-controlled AVIF files. GitHub's advisory describes it as unauthenticated remote code execution caused by a heap buffer overflow in libheif, the C library used by sharp to parse and process AVIF images.
Affected versions and required patches
For the Windows path traversal flaw, Vercel says Next.js versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2 are affected. Fixes were released in Next.js 15.5.24 for the Maintenance LTS line and 16.3.3 for the Active LTS line.
For the AVIF issue in the Image Optimization API, the advisory lists a broader scope: Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. Engineering teams can upgrade the Next.js package to version 15.5.24 or 16.3.3 depending on the branch they use.
Vercel says applications hosted on the Vercel platform are already protected against both vulnerabilities and do not need a separate upgrade for protection on Vercel infrastructure. However, organizations self-hosting Next.js, especially on Windows or with image optimization enabled, should still perform an independent review.
Why this alert matters to enterprises
Next.js often sits at the public-facing layer of a web application. When a vulnerability appears in request handling or image processing, attackers may be able to target an internet-exposed surface without valid credentials. That significantly raises the risk for e-commerce systems, customer portals, internal dashboards exposed through VPN, and self-hosted SaaS applications.
For the AVIF flaw, the risk is also tied to the fact that image optimization is often treated as a default supporting feature. If an image pipeline accepts data from users, CMS platforms, partners, or external URLs, a malicious image file can become an entry point for memory corruption in a native library.
Recommended response
Operations teams should inventory applications using Next.js, identify the actual version in lockfiles and runtime environments, and prioritize upgrades for self-hosted systems. On Windows servers, the issue should be handled as an emergency patch if the application matches the affected configuration.
Development teams should also review the Image Optimization API, image intake policies, and unusual logs tied to AVIF processing. In the short term, limiting trusted image sources, monitoring abnormal requests, and controlling dependency updates for sharp and libheif can help reduce exposure while upgrades are completed.
The case shows that modern frameworks need to be kept current not only at the JavaScript layer, but across the full dependency chain that handles images, filesystems, and native components underneath. For public web applications, framework version management should be treated as part of security risk management, not merely routine technical maintenance.
VNCyberS compiled from The Hacker News, Vercel, and GitHub Security Advisory
Tiếng Việt
English