> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE - URL: https://f4n6.co.uk/security-feed/next-js-patches-critical-avif-and-windows-flaws-enabling-unauthenticated-rce/ - Published: 2026-08-27T21:09:48.000Z - Updated: 2026-08-27T21:09:48.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-75604 ## 1\. Executive summary Vercel has released patches for two critical-severity vulnerabilities in the Next.js web framework enabling unauthenticated remote code execution (RCE). CVE-2026-75604 (CVSS 9.0) is a Windows-only path traversal flaw affecting Next.js applications using Pages Router and App Router without Cache Components; Linux and macOS deployments are not affected. A second flaw (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) is a heap buffer overflow in the libheif library (via the sharp image processing package) triggered by a crafted AVIF image file, exploitable only when `image/avif` is explicitly configured in `next.config.js`. No verified CISA-KEV exploitation data was resolved for this item. EMEA financial services running Next.js on Windows infrastructure or with AVIF optimisation enabled should treat patching as urgent. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 24: digital operational resilience testing — general requirements | Two unauthenticated RCE vectors in a web framework component require immediate patch validation and regression testing before deployment to production. | Clients must verify that patched Next.js versions (15.5.24 / 16.3.3) pass functional and security testing before promotion, documenting the test results under their ICT resilience testing programme. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Critical-severity unauthenticated RCE vulnerabilities in a framework likely used in customer-facing applications constitute a cyber threat requiring classification under the client's ICT incident taxonomy. | Clients should classify the exposure (pre-patch) as a cyber threat and assess whether any resulting compromise would meet the major-incident threshold under Art. 19. | No NIS2 or UK NIS articles are specifically engaged beyond generic incident-reporting obligations, which would apply only upon confirmed exploitation and major-impact thresholding. ## 3\. Technical analysis & attack chain ### Vulnerability 1: CVE-2026-75604 — Windows path traversal (CVSS 9.0, Critical) - **Affected component:** Next.js applications using both Pages Router and App Router without Cache Components, running on a Windows filesystem. - **Affected versions:** Next.js 13.4 through 15.5.23; 16.0 through 16.3.2. - **Not affected:** Linux and macOS deployments; applications hosted on Vercel's platform; applications using Cache Components. - **Attack vector:** Unauthenticated, remote. The specific attack mechanism was not disclosed by Vercel. - **Impact:** Unauthenticated remote code execution. - **Researchers credited:** evolutionstorm and B0RI (responsible disclosure). - **Workaround:** None. Vercel states: "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." ### Vulnerability 2: GHSA-2xp9-vwfh-vxw4 — libheif heap buffer overflow via AVIF (CVSS v4 9.5, Critical) - **Affected component:** Next.js image optimisation pipeline. Next.js uses the `sharp` package for image processing; `sharp` relies on the `libheif` C library to parse AVIF files. - **Affected versions:** Next.js 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2\. All libheif versions through v1.23.1 are affected. - **Exposure condition:** Next.js enables AVIF optimisation only when a site explicitly adds `image/avif` to the `formats` configuration in `next.config.js`. Deployments without that configuration are not exposed. - **Attack chain (confirmed from source):** 1\. Attacker submits a crafted AVIF image file to a Next.js application with AVIF optimisation enabled. 2\. The AVIF file contains nested identity-derivation and auxiliary item references. 3\. libheif builds a decoded image with two Alpha plane entries at different bit depths. 4\. The scaler allocates a destination buffer sized for the first 8-bit Alpha entry. 5\. The scaler then writes 16-bit sample values from the second Alpha entry into that same buffer. 6\. This overwrites approximately 16,384 bytes past the allocation boundary — a heap buffer overflow. 7\. The researchers (rootxharsh as Finder, KarimPwnz as Coordinator) released a full Python proof-of-concept that reproduces the heap corruption under an address sanitizer build. 8\. The researchers claim: "We were able to get RCE using this on multiple applications." - **Confidence caveat:** The RCE claim is single-sourced (researcher statement in the libheif advisory); it has not been independently corroborated. The PoC demonstrates the out-of-bounds write; reliable RCE exploitation has not been confirmed by third parties. Verify before treating as weaponised. - **Attribution note:** Vercel's changelog attributed the disclosure to the "Hacktron team." No MITRE profile was resolved for this entity; attribution is unconfirmed. - **Upstream fix status:** As of August 27, 2026, libheif v1.23.2 had not been published. The patched Next.js releases mitigate by turning off AVIF optimisation entirely until the upstream libheif fix propagates. ### Patch details - Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published August 25, 2026. - Vercel moved the release forward by one day (from August 26) after identifying an additional critical-severity vulnerability in an upstream dependency. - Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **Inventory and assess:** Identify all Next.js deployments in your environment. Determine: - Whether the server uses a Windows filesystem (CVE-2026-75604 exposure). - Whether `next.config.js` contains `image/avif` in the `formats` array (GHSA-2xp9-vwfh-vxw4 exposure). 2. **Patch Windows-hosted applications immediately:** There is no workaround. Upgrade: - `npm install next@15.5.24` (for the 15.5 line) - `npm install next@16.3.3` (for the 16.3 line) 3. **Patch AVIF-enabled applications immediately:** Same upgrade paths as above. The patched releases disable AVIF optimisation as a mitigation until libheif v1.23.2 is available upstream. ### P2 — Within 72 hours 1. **Patch all remaining Next.js deployments** in the affected version ranges (13.4–15.5.23, 16.0–16.3.2), regardless of OS or AVIF configuration, to eliminate both vectors. 2. **Verify Vercel-hosted applications** are protected — no action required, but confirm hosting arrangement in asset records. 3. **Block or restrict unauthenticated image upload endpoints** at the WAF/reverse proxy layer for AVIF-enabled applications that cannot be immediately patched. This is a containment measure, not a substitute for patching. ### P3 — Within 7 days 1. **Monitor for libheif v1.23.2 release** and plan to re-enable AVIF optimisation once the upstream fix is available and the Next.js release incorporating it is installed. 2. **Conduct regression testing** on patched applications — the AVIF optimisation disablement may affect image delivery performance for applications relying on AVIF format output. 3. **Review image-processing attack surface:** Assess whether other image formats processed by sharp/libheif present similar risk; consider restricting accepted upload formats to the minimum necessary. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------------------------------- | | Unauthenticated POST/PUT requests containing AVIF image data to Next.js image optimisation or upload endpoints | Web server access logs; WAF logs; Next.js server logs | Medium — consistent with the confirmed attack vector | | Out-of-bounds memory writes in the sharp/libheif process (crash, ASAN report) | Server crash logs; process monitoring; container restart logs | High — confirmed by PoC under address sanitizer | | Unexpected file access patterns traversing Windows filesystem paths | EDR file access monitoring; Windows Event Logs | Low — mechanism not disclosed by vendor | ## 6\. Detection Insufficient indicators to author detection rules. The source material describes the vulnerability mechanism and a Python PoC exists, but no file hashes, distinctive strings, command-line artefacts, mutex names, or network signatures were provided in the available sources. The AVIF PoC is not publicly available in the source material for string extraction. ## 7\. Sources - The Hacker News — "Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE" — https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html — 2026-08-27 - BSI Germany (WID-SEC-2026-3027) — "\[NEU\] \[kritisch\] Vercel Next.js: Mehrere Schwachstellen ermöglichen Codeausführung" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3027 - BSI Germany (WID-SEC-2026-0748) — "\[UPDATE\] \[mittel\] Vercel Next.js: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0748 - BSI Germany (WID-SEC-2026-2468) — "\[NEU\] \[hoch\] Vercel Next.js: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2468 ## 8\. Adverse Trace position Both vulnerabilities are critical-severity unauthenticated RCE vectors in a widely deployed web framework. CVE-2026-75604 is the more urgent for EMEA financial services with Windows-hosted Next.js deployments — there is no workaround and the attack mechanism has not been disclosed, meaning defensive detection beyond patching is not feasible. The AVIF/libheif flaw is exploitable only when explicitly configured but has a confirmed PoC and a researcher-claimed (single-sourced, uncorroborated) RCE on multiple applications; treat as weaponised-capable but verify independently. No CISA-KEV exploitation data was resolved for either CVE. Clients should prioritise patching Windows-hosted and AVIF-enabled Next.js applications within 24 hours and all remaining instances within 72 hours. Adverse Trace will monitor for libheif v1.23.2 release, any public PoC publication, and KEV addition, and will update this advisory if exploitation is confirmed in the wild. --- [Read the original source →](https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*