FHN 
Two critical security issues in Next.js could allow attackers to execute code remotely on vulnerable applications without logging in.
The first vulnerability, CVE-2026-75604, affects applications using the Image Optimization API on Windows servers. It is related to improper handling of file paths and can allow attackers to access files outside the intended application directory.
The issue affects certain Next.js versions using either the Pages Router or App Router, particularly when running on Windows-based systems.
Windows Applications Face Path Traversal Risk
The vulnerability is caused by insufficient restrictions on attacker-controlled file paths. By sending a specially crafted request, an attacker could potentially make the application access unintended locations on the server.
Successful exploitation could result in:
- Exposure of sensitive files
- Unauthorized modification of server content
- Disruption of application availability
The flaw requires no authentication or user interaction, although the advisory rates exploitation complexity as high.
Vercel has addressed the issue in Next.js 15.5.24 and 16.3.3. There is no reliable workaround for affected Windows deployments, making an update the recommended solution.
Malicious AVIF Images Could Trigger RCE
The second critical issue affects applications using the Image Optimization API to process AVIF images.
The problem is linked to libheif, an image-processing component used through the Sharp package. An attacker could submit a specially crafted AVIF image to a vulnerable image optimization endpoint.
If the malicious file is processed by the affected component, it could potentially lead to remote code execution on the server.
The vulnerability affects a wide range of Next.js releases, with fixes available in 15.5.24 and 16.3.3.
Next.js temporarily disabled AVIF optimization as a protective measure while the dependency issue was being addressed, but organizations should still upgrade their applications rather than relying on this mitigation.
Update Next.js Deployments
Organizations using Next.js should update to a patched release and rebuild their production applications or containers.
Security teams should also review:
- Public image-upload and image-optimization endpoints
- Windows-hosted Next.js applications
- Logs for unusual file-path requests
- Suspicious AVIF image-processing activity
Keeping both Next.js and its underlying dependencies updated is important because vulnerabilities in supporting libraries can also create serious risks for applications built on the framework.
About the Author
