Vercel releases Next.js fixes for critical Windows and AVIF RCE flaws

Vercel has released Next.js 15.5.24 and 16.3.3 to fix two critical vulnerabilities that could allow unauthenticated remote code execution in self-hosted applications. One issue is a Windows-specific path traversal flaw tracked as CVE-2026-75604 and scored 9.0 on CVSS; the other involves AVIF image optimisation and an underlying heap buffer overflow in libheif.

The patched releases were published on August 25, 2026. Next.js 15.5.24 is the Maintenance LTS release and 16.3.3 is the Active LTS release. Vercel said applications hosted on its platform are protected from both issues and require no customer upgrade, while affected self-hosted deployments need to update.

Windows path traversal affects specific router configurations

CVE-2026-75604 affects Next.js versions 13.4 through 15.5.23 and 16.0 through 16.3.2 when the server uses a Windows filesystem. The vulnerable configuration combines the Pages Router and App Router without Cache Components. Linux and macOS deployments are not affected by this flaw.

Vercel did not disclose the attack mechanism. It said there is no known workaround for affected Windows-hosted applications and advised administrators to upgrade immediately. The changelog credits researchers evolutionstorm and B0RI with responsibly reporting the issue.

AVIF processing reaches vulnerable libheif code

The second issue concerns Next.js image optimisation. Next.js uses the sharp package, which relies on the libheif C library to parse AVIF files. Libheif versions through 1.23.1 contain a heap buffer overflow in image scaling, identified as GHSA-g89c-p67h-r497. The related Next.js advisory is GHSA-2xp9-vwfh-vxw4 and has a CVSS v4 score of 9.5.

A specially constructed AVIF file can cause libheif to create two Alpha plane entries with different bit depths. Its scaler allocates a buffer for the first 8-bit entry, then writes 16-bit values from the second entry into that allocation. The disclosure describes an overwrite of about 16,384 bytes beyond the buffer boundary. Researchers published a Python proof of concept that reproduces the heap corruption under an address-sanitizer build; their claim of remote code execution on multiple applications had not been independently corroborated.

The AVIF issue affects Next.js 10.0.0 through 15.5.23 and all 16.x versions through 16.3.2, but only where administrators explicitly added image/avif to the formats configuration in next.config.js. Deployments that do not enable AVIF optimisation are not exposed through this path. The patched releases disable AVIF optimisation until an upstream libheif fix propagates; libheif 1.23.2 had not been published as of August 27.

Patch priority for self-hosted teams

Vercel moved its planned August security release forward by one day after identifying the additional upstream critical issue. The company also noted that users already running its July Next.js security releases still need this update. No exploitation of either August vulnerability had been reported as of August 27, 2026.

For self-hosted organisations, the immediate business task is to identify Next.js installations and upgrade the 15.5 line with npm install next@15.5.24 or the 16.3 line with npm install next@16.3.3. Teams operating on Windows should treat the update as urgent, while all operators should verify whether AVIF optimisation is enabled and ensure the new release reaches every production environment.