Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Two Critical Next.js RCE Paths Put Self-Hosted Deployments on Alert

The latest Next.js RCE security update addresses two critical vulnerabilities that can allow unauthenticated remote code execution. Vercel released Next.js 15.5.24 and 16.3.3 to fix the issues. One affects specific Windows-hosted deployments, while the other involves AVIF image optimization and an upstream libheif vulnerability.

However, the two Next.js RCE vulnerabilities have different prerequisites and affected version ranges. However, both can allow exploitation without authentication when the required conditions exist.

CVE-2026-75604 is a critical path traversal vulnerability affecting Windows-hosted Next.js applications. It carries a CVSS v3.1 score of 9.0. The AVIF issue, GHSA-2xp9-vwfh-vxw4, carries a CVSS v4.0 score of 9.5.

Vercel published the patched Next.js releases on August 25, 2026. No exploitation of either vulnerability had been publicly reported as of August 27, according to The Hacker News.

Next.js August 2026 vulnerabilities at a glance

How CVE-2026-75604 Creates a Windows Next.js RCE Risk

CVE-2026-75604 is tracked through GitHub advisory GHSA-p293-qw3h-jr36 and classified as CWE-22, or path traversal.

However, the flaw does not affect every Next.js deployment.

The vulnerable configuration requires an application to:

• run on a Windows filesystem;
• use both the Pages Router and App Router;
• operate without Cache Components; and
• run an affected Next.js version.

Affected releases include Next.js versions from 13.4 through versions before 15.5.24. Next.js 16.x releases before 16.3.3 are also affected.

Successful exploitation can result in unauthenticated remote code execution. The CVSS vector reflects network-based exploitation with no privileges or user interaction required. However, attack complexity is rated high.

Importantly, the published Next.js advisory does not provide enough technical detail to responsibly reconstruct the complete path traversal-to-RCE sequence. Therefore, organizations should avoid relying on speculative exploit descriptions when investigating exposure.

Vercel states that there is no known workaround for affected Windows-hosted applications. Therefore, affected organizations should upgrade immediately.

How the AVIF Next.js RCE Path Reaches libheif

Meanwhile, the second vulnerability follows a separate path through the Next.js image-processing stack.

Next.js uses sharp for image optimization. Sharp, in turn, relies on libheif for HEIF and AVIF processing. The Next.js advisory tracks the issue as GHSA-2xp9-vwfh-vxw4 and links it to upstream libheif advisory GHSA-g89c-p67h-r497.

The upstream vulnerability is a heap buffer overflow in HeifPixelImage::scale_nearest_neighbor().

A specially crafted HEIF or AVIF structure can create duplicate alpha planes with different bit depths. During scaling, libheif can allocate the destination alpha plane using an 8-bit size. It can later process a 10-bit alpha plane as 16-bit data.

As a result, that mismatch causes an out-of-bounds heap write. The libheif researchers reported achieving remote code execution against multiple applications, although independent researchers had not corroborated the RCE claim as of August 27.

For Next.js, this attack surface exists when administrators explicitly enable AVIF optimization and an attacker-controlled AVIF image reaches the Image Optimization API.

The Next.js advisory rates the issue critical with a CVSS v4.0 score of 9.5. The official Next.js advisory lists the affected version ranges as >=10.0.0 <15.5.24 and <16.3.3, with fixes available in 15.5.24 and 16.3.3.

Next.js 15.5.24 and 16.3.3 address the immediate risk by disabling AVIF optimization while the upstream fix propagates. The libheif advisory identifies v1.23.2 as the patched version, although The Hacker News reported that the release was not yet published as of August 27.

Which Next.js Deployments Need Immediate Review?

The two vulnerabilities require different exposure checks. Therefore, teams should avoid treating them as a single configuration problem.

For CVE-2026-75604, identify Next.js servers running on Windows. Then determine whether applications use both routing models without Cache Components.

By contrast, for the AVIF vulnerability, first check whether the application enables AVIF optimization by adding image/avif to the formats configuration in next.config.js. If it does, assess whether attacker-controlled AVIF images can reach the Next.js Image Optimization API.

Additionally, organizations should also inventory the exact Next.js versions deployed across development, staging and production environments.

Applications hosted directly on Vercel are protected from these vulnerabilities and require no customer action, according to Vercel. Self-hosted deployments and environments running through other infrastructure should assess their own exposure.

Patch Next.js Through the Application Deployment Workflow

The primary remediation is straightforward: upgrade Next.js.

Affected organizations should move supported deployments to:

• Next.js 15.5.24 or later for the 15.5 release line; or
• Next.js 16.3.3 or later for the 16.x release line.

For CVE-2026-75604, the Next.js advisory provides no workaround for affected Windows-hosted applications.

Moreover, teams should also identify older deployments that may have escaped normal application inventories. The AVIF vulnerability reaches considerably further back than the Windows issue, affecting Next.js releases beginning with version 10.0.0.

After upgrading, rebuild and redeploy applications through the organization’s established npm, CI/CD, container or software-deployment workflow.

This distinction is important. Operating-system or endpoint patching alone does not update a vulnerable Next.js dependency inside an application.

Afterward, security teams should then review relevant server and endpoint telemetry if they have evidence suggesting attempted exploitation.

Featured resource

Hexnode UEM for Patch Management

See how Hexnode centralizes patch management across supported Windows and macOS devices with automated deployment and update visibility.

Download the One-pager

Where Hexnode Fits Into the Next.js RCE Response

Hexnode does not patch the vulnerable Next.js dependency. Instead, Hexnode UEM helps IT teams manage relevant Windows environments, while Hexnode XDR helps security teams investigate suspicious endpoint activity when they suspect exploitation.

Hexnode UEM: Maintain Visibility Across Supporting Windows Environments

Hexnode UEM supports management of Windows Server 2019, Windows Server 2022 and Windows Server 2025.

For organizations running Next.js on supported Windows Server systems, centralized endpoint management can complement the application’s remediation workflow. IT teams can maintain management and configuration visibility across relevant Windows systems and administrator endpoints.

Hexnode UEM also provides Windows patch management and application-management capabilities on supported Windows endpoints. Hexnode separately documents custom-script execution for supported Windows 10 and Windows 11 PCs and tablets.

However, they should not be confused with the vulnerability fix itself.

Next.js is distributed through npm. Organizations must update vulnerable Next.js applications through their established package-management, build and deployment workflow. Hexnode UEM should not be positioned as directly patching the affected Next.js npm dependency.

Hexnode XDR: Investigate Suspicious Activity After Suspected Exploitation

Successful RCE can allow an attacker to execute code within the vulnerable application’s available context. If security teams suspect exploitation on a supported Windows endpoint, they can use Hexnode XDR to investigate the resulting endpoint activity.

Relevant telemetry can include:

• process creation;
• file creation and deletion;
• network connections;
• registry modifications; and
• login events.

Process Tree analysis can help investigators examine parent-child process relationships associated with detected threats. Query-based investigation can provide additional endpoint context when analysts need to test a specific hypothesis.

When malicious endpoint activity is identified, documented response actions can support containment and remediation. Depending on the activity involved, these can include endpoint isolation, process termination, process-tree termination, file quarantine and malicious file deletion.

These capabilities apply to suspicious endpoint activity associated with a suspected compromise. Hexnode XDR should not be interpreted as detecting CVE-2026-75604 or the AVIF vulnerability by name.

Likewise, XDR does not replace the Next.js upgrade. Removing the vulnerable application path remains the primary remediation.

What Enterprises Should Do Now

Organizations operating Next.js should prioritize five actions:

1. Inventory Next.js deployments. Identify versions across production, staging, development and internally hosted applications.
2. Check Windows exposure. Locate Windows-hosted applications using both Pages Router and App Router without Cache Components.
3. Review AVIF processing. Determine whether attacker-controlled AVIF images can reach affected Next.js Image Optimization workflows.
4. Upgrade affected applications. Move deployments to Next.js 15.5.24, 16.3.3 or a later secure release through the appropriate application deployment workflow.
5. Investigate suspicious activity where warranted. Review process, file and network telemetry when other evidence suggests attempted or successful exploitation.

Cloudflare’s August 26 emergency WAF release refined the metadata description of an existing Next.js RCE rule for CVE-2026-75604, with detection unchanged, and added a new blocking rule for crafted-AVIF RCE through the Next.js Image Optimizer. Such controls can provide an additional defensive layer. However, organizations should still apply the Next.js update.

Two RCE Flaws, Two Attack Surfaces, One Patch Priority

The August Next.js security release addresses two distinct routes to unauthenticated code execution.

CVE-2026-75604 makes the Windows hosting environment and router configuration critical to exposure. The AVIF vulnerability instead shows how an upstream image-processing dependency can extend a framework’s attack surface.

For self-hosted enterprises, the immediate priority is to determine whether either condition exists and upgrade to Next.js 15.5.24, 16.3.3 or a later secure release.

Hexnode UEM helps IT teams manage relevant Windows environments, while Hexnode XDR helps security teams investigate endpoint activity when they suspect exploitation. Organizations must still apply the application-level update to remove the vulnerable Next.js code path.