Skip to main content
IMMUNITYSEC
Vulnerabilities

Next.js Unauthenticated RCE: CVE-2026-75604 Windows Path Traversal and the AVIF libheif Heap Overflow

2026-08-26•Updated 2026-08-27•5 min read

Vercel's accelerated August 25, 2026 Next.js security release patched two unrelated critical, unauthenticated remote code execution flaws: a Windows-only path traversal (CVE-2026-75604, CVSS 9.0) with no workaround and a public PoC, and an AVIF image-decoding heap overflow (GHSA-2xp9-vwfh-vxw4, CVSS 4.0 9.5) inherited from the libheif library via the sharp dependency.

Core Technical Takeaways

  • >CVE-2026-75604 (CVSS 3.1 9.0) is a Windows-specific path traversal to unauthenticated RCE affecting Next.js apps using both the Pages Router and App Router without Cache Components; Vercel states there is no workaround for Windows-hosted deployments.
  • >GHSA-2xp9-vwfh-vxw4 (CVSS 4.0 9.5) is a heap buffer overflow in upstream libheif reached via the sharp dependency when AVIF image optimization is enabled; Next.js's fix disables AVIF optimization pending an upstream libheif fix (GHSA-g89c-p67h-r497).
  • >Both flaws are fixed in Next.js 15.5.24 and 16.3.3; affected ranges are 13.4 to 15.5.23 and 16.0 to 16.3.2 for the Windows flaw, and 10.0.0 through the patched versions for the AVIF flaw.
  • >A public proof-of-concept for CVE-2026-75604 was posted to GitHub on disclosure day, and Fastly and Cloudflare shipped WAF virtual-patch rules; no confirmed in-the-wild exploitation was reported as of August 27, 2026.

Overview of the August 25, 2026 Next.js security release

Vercel published an accelerated August security release for Next.js patching two unrelated critical-severity vulnerabilities, each permitting unauthenticated remote code execution. The release date was moved up after engineers identified an additional critical flaw in an upstream dependency during the disclosure window. Per the Cloud Security Alliance research note, the two issues share a release window but nothing else in root cause. Next.js draws roughly 45 million weekly npm downloads, making rapid scanning and exploitation attempts likely.

Attribute CVE-2026-75604 (Windows path traversal) GHSA-2xp9-vwfh-vxw4 (AVIF decode overflow)
Severity CVSS 3.1: 9.0 (Critical) CVSS 4.0: 9.5 (Critical)
Root cause Path handling divergence on Windows filesystems (CWE-22) Heap buffer overflow in upstream libheif AVIF decoder, reached via sharp
Trigger condition Pages Router + App Router without Cache Components, Windows-hosted server AVIF image optimization explicitly enabled
Affected versions 13.4 to 15.5.23, 16.0 to 16.3.2 10.0.0 through <15.5.24 and <16.3.3
Patched versions 15.5.24, 16.3.3 15.5.24, 16.3.3 (AVIF optimization disabled pending upstream fix)
Workaround None Disable AVIF optimization

CVE-2026-75604: Windows path traversal to unauthenticated RCE

The GitHub advisory GHSA-p293-qw3h-jr36 assigns CVE-2026-75604 a CVSS 3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), classified under CWE-22 (Path Traversal). The flaw affects Next.js apps using both the Pages Router and the App Router without Cache Components enabled, when the server filesystem is Windows. Because Windows resolves path separators, drive letters, and reserved device names differently than POSIX systems, request-supplied path segments that Next.js's routing assumed were safely contained can resolve outside the application directory and reach code execution. Vercel credits researchers evolutionstorm and B0RI and states there is no workaround for affected Windows-hosted applications. A public PoC was posted to GitHub on disclosure day, and Fastly and Cloudflare shipped WAF virtual-patch rules.

GHSA-2xp9-vwfh-vxw4: AVIF image parsing to unauthenticated RCE

The second vulnerability (CVSS 4.0: 9.5) comes from how libheif processes maliciously crafted AVIF image containers. Per the upstream libheif advisory (GHSA-g89c-p67h-r497), a crafted AVIF file with nested identity-derivation and auxiliary item references causes libheif to construct a decoded image with two alpha-plane entries at different bit depths, producing out-of-bounds heap writes during image scaling. Because Next.js's Image Optimization API calls sharp → libheif to decode AVIF inputs, any deployment with AVIF output enabled that processes attacker-influenced image URLs inherits this as a remotely reachable, unauthenticated code-execution path. Vercel's fix disables AVIF optimization outright until a corrected libheif build propagates. The libheif advisory credits researcher rootxharsh (finder) and coordinator KarimPwnz; the Vercel changelog attributes the disclosure to the Hacktron research team.

Remediation

  1. 1.
    Upgrade immediately to Next.js 15.5.24 or 16.3.3. This is an emergency patch, not routine cadence, for Windows-hosted deployments or those with AVIF optimization enabled.
  2. 2.
    Inventory Windows-hosted Next.js deployments first. CVE-2026-75604 has no workaround and a public PoC.
  3. 3.
    Disable AVIF optimization as a temporary control if you cannot immediately upgrade and AVIF output is enabled.
  4. 4.
    Deploy WAF virtual patches from Fastly or Cloudflare in front of internet-exposed Next.js origins while upgrades proceed.
# Check the installed Next.js version
npm ls next

# Confirm whether AVIF optimization is enabled
grep -Rni "avif" next.config.* 2>/dev/null