Critical Next.js Flaws Enable Unauthenticated Remote Code Execution

Red | Vulnerability

TA2026251 | Critical Next.js Flaws Enable Unauthenticated Remote Code Execution | HivePro Threat Advisory

Overview

Summary

Vercel disclosed two critical, unauthenticated remote code execution vulnerabilities in Next.js on 25 August 2026: one tracked as CVE-2026-75604 (CVSS 9.0) and a second image-optimization flaw (CVSS 9.5) still pending a CVE assignment. Both vulnerabilities affect self-hosted Next.js deployments only, with applications running on Vercel's managed platform unaffected. No in-the-wild exploitation has been confirmed for either flaw, though a public proof-of-concept for CVE-2026-75604 surfaced within roughly 24 hours of disclosure, raising near-term risk for exposed, self-hosted, Windows-hosted deployments. Both issues are resolved in Next.js 15.5.24 and 16.3.3, and self-hosted deployments should upgrade to a patched release immediately to close off remote code execution exposure.

CVE ID	Name	Affected Product
`CVE-2026-75604`	Vercel Next.js Windows-Hosted Remote Code Execution Vulnerability	Vercel Next.js
Pending — `GHSA-2xp9-vwfh-vxw4` / `GHSA-g89c-p67h-r497`	Vercel Next.js AVIF Image Optimization Remote Code Execution Vulnerability	Vercel Next.js

Technical Analysis

Vulnerability Details

Disclosure Overview

On 25 August 2026, Vercel disclosed two critical, unauthenticated remote code execution vulnerabilities in Next.js. One carries a CVE identifier, CVE-2026-75604 (GHSA-p293-qw3h-jr36), while the second is currently tracked only by GitHub advisories, GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497, with a CVE assignment still pending.

Scope And Severity

Next.js is a widely deployed React-based web framework maintained by Vercel, with a footprint of roughly 45 million weekly downloads, making any critical flaw in it broadly consequential. Both vulnerabilities are rated Critical: CVE-2026-75604 at CVSS 9.0 and the second flaw at CVSS 9.5. Each enables unauthenticated remote code execution, though exposure is concentrated in self-hosted deployments, as applications hosted on Vercel's managed platform are not affected by either issue.

Root Cause And Exploitation Conditions

CVE-2026-75604 is a path traversal weakness that leads to code execution, but only under a narrow set of conditions: the server must run on a Windows filesystem, the application must use both the Pages Router and the App Router, and it must operate without Cache Components. Linux and macOS hosts are unaffected. The second flaw originates in an underlying image-processing library used for image optimization and is triggered when a crafted AVIF image is passed to a vulnerable image optimization endpoint.

Affected Versions And Exploitation Status

In terms of scope, CVE-2026-75604 affects versions from 13.4 up to 15.5.24, and from 16.0 up to 16.3.3. The second flaw reaches further back, affecting versions from 10.0.0 up to 15.5.24 and below 16.3.3. No in-the-wild exploitation has been confirmed for either flaw to date. However, a public proof-of-concept for CVE-2026-75604 was released within roughly 24 hours of disclosure, elevating near-term risk for exposed Windows-hosted deployments.

Remediation Status

Both vulnerabilities are resolved in Next.js 15.5.24 and 16.3.3. No workaround exists for the Windows-hosted flaw, so upgrading is the only remediation; for the second flaw, the patched releases disable AVIF optimization until an upstream fix propagates. Self-hosted deployments should upgrade immediately.

CVE, CPE & CWE Reference

CVE ID	Affected Products	Affected CPE	CWE ID
`CVE-2026-75604`	Vercel Next.js (>= 13.4 and < 15.5.24; >= 16.0 and < 16.3.3) on Windows filesystem hosts using Pages Router and App Router without Cache Components	`cpe:2.3:a:vercel:next.js::::::node.js::*`	`CWE-22`
—	Vercel Next.js (>= 10.0.0 and < 15.5.24; < 16.3.3), Image Optimization API processing AVIF input	`cpe:2.3:a:vercel:next.js::::::node.js::*`	—
—	libheif (<= 1.23.1), upstream root cause reached via sharp	`cpe:2.3:a:strukturag:libheif::::::::`	—

Mitigation Guidance

Recommendations

Upgrade Next.js Without Delay

Self-hosted applications should upgrade to Next.js 15.5.24 (Maintenance LTS) or 16.3.3 (Active LTS), which remediate both disclosed vulnerabilities. Install the patched build with npm install next@15.5.24 for 15.x deployments or npm install next@16.3.3 for 16.x deployments, then rebuild and redeploy. This is the only complete remediation for the Windows-hosted flaw and the most direct containment for the AVIF flaw.

Treat Windows-Hosted Servers as Highest Priority

Because CVE-2026-75604 has no known workaround and grants unauthenticated remote code execution, any Next.js server running on a Windows filesystem that uses both the Pages Router and the App Router without Cache Components should be patched ahead of all other systems. Where immediate patching is not feasible, consider temporarily relocating the affected workload to a Linux or macOS host, which the vendor states are not affected.

Patch libheif Everywhere It Is Embedded

The root cause is a heap buffer overflow in libheif 1.23.1 and earlier, corrected in 1.23.2. Because libheif is embedded across many image-handling stacks beyond Next.js, inventory all applications and services that decode HEIC, HEIF, or AVIF content through libheif or sharp and update them to a build incorporating libheif 1.23.2 or later.

Confirm Your Hosting Exposure

Applications hosted on the vendor's managed platform are already protected and require no customer action, as the platform disabled AVIF optimization and runs a Linux-based runtime not affected by the Windows flaw. Distinguish managed from self-hosted deployments across the estate so that remediation effort is directed only where it is required.

Constrain Untrusted AVIF Processing

Until every dependency in the image pipeline is confirmed patched, avoid passing attacker-controlled AVIF, and more broadly HEIC and HEIF, input through Image Optimization. The patched Next.js releases already disable AVIF optimization and serve such inputs unmodified; on unpatched systems, restrict or disable AVIF handling at the application or proxy layer as an interim mitigation.

Adversary Tradecraft

Potential MITRE ATT&CK TTPs

Initial Access

T1190

Exploit Public-Facing Application

Execution

T1059

Command and Scripting Interpreter

Resource Development

T1588 → T1588.006

Obtain Capabilities: Vulnerabilities

References & Patch Links

Patch Links

References

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro