Vercel has patched two critical remote code execution flaws in Next.js: one that triggers when the framework optimizes an attacker-supplied AVIF image, and one that only fires when the server runs on a Windows filesystem. Both fixes shipped in Next.js 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS) on August 25, 2026, a day ahead of the scheduled release date.
The Windows flaw is tracked as CVE-2026-75604 (GHSA-p293-qw3h-jr36), a path traversal bug (CWE-22) rated CVSS 9.0 and reported by researchers evolutionstorm and B0RI. The image flaw, GHSA-2xp9-vwfh-vxw4, has no CVE assigned and carries a CVSS v4 score of 9.5. Neither requires authentication nor user interaction.
How the AVIF flaw reaches code execution
The AVIF bug is not in Next.js code. Next.js uses sharp to optimize images, sharp links libheif to decode AVIF, and libheif carries a heap buffer overflow disclosed upstream as GHSA-g89c-p67h-r497.
A crafted file nests identity-derivation (iden) and auxiliary (auxl) item references until the decoded image holds two Alpha planes at different bit depths. HeifPixelImage::scale_nearest_neighbor() sizes the destination buffer from the first, 8-bit plane, then takes the HDR write path for the second, 10-bit plane, and writes two bytes per sample into a one-byte-per-sample allocation.
In the published proof of concept, a 16,384-byte buffer receives 32,768 bytes. Both the overflow length and the bytes written are attacker-controlled. The finders, rootxharsh and KarimPwnz, report in the advisory: "We were able to get RCE using this on multiple applications."
Which versions are affected
| Package | Affected versions | Patched |
|---|---|---|
next — Windows RCE (CVE-2026-75604) | ≥ 13.4 < 15.5.24 ≥ 16.0 < 16.3.3 | 15.5.24, 16.3.3 |
next — AVIF RCE (GHSA-2xp9-vwfh-vxw4) | ≥ 10.0.0 < 15.5.24 < 16.3.3 | 15.5.24, 16.3.3 |
libheif (upstream) | ≤ 1.23.1 | 1.23.2 |
CVE-2026-75604 only affects applications that use both the Pages Router and App Router without Cache Components, running on a Windows filesystem. Linux and macOS hosts are not affected.
How to patch Next.js
npm install [email protected] # for the 15.5 line
npm install [email protected] # for the 16.3 lineThere is no workaround for the Windows flaw; Vercel's advisory tells affected operators to "upgrade immediately". Applications hosted on Vercel need no action because the platform runs Linux and disables AVIF optimization across its managed Image Optimization service. Netlify sites rewrite /_next/image to their own image CDN and never invoke the affected code path, though Netlify still recommends upgrading.
Why AVIF optimization stays switched off after patching
Upgrading does not restore AVIF processing. The patched releases disable AVIF optimization outright and serve those files as-is, and they stay that way until a fixed libheif propagates through sharp's prebuilt binaries — a three-hop chain running libheif to libvips to sharp to Next.js. Cyber Kendra has not independently confirmed that a fixed build has reached sharp, so sites relying on AVIF should plan for heavier image payloads in the interim.
The upstream picture explains why that hop is slow. libheif describes the project as "maintained by a single independent developer with almost no recurring funding", against 37 security advisories investigated and released in 2026 alone. Every Next.js deployment that touches AVIF inherits that capacity constraint.
Is CVE-2026-75604 being exploited?
Neither flaw appears in CISA's Known Exploited Vulnerabilities catalog as of August 28, 2026, and no vendor has reported in-the-wild exploitation. A working exploit primitive is public; however, the libheif advisory ships a Python generator that builds the malicious HEIC file and reproduces the heap corruption under AddressSanitizer, so any assessment that treats this as a no-PoC issue is out of date.
For detection, review /_next/image access logs for AVIF inputs sourced from untrusted or remote origins, and check whether images.remotePatterns or images.domains allows third-party hosts. Windows operators should audit route-handling logs for traversal-style path segments. A crash in the sharp worker process is the most likely observable artifact of a failed attempt.