Next.js Fixes Two Critical RCE Vulnerabilities

Vercel has released security updates for two critical vulnerabilities in Next.js that could allow unauthenticated attackers to achieve remote code execution.

The first flaw, CVE-2026-75604, is a Windows-specific path traversal vulnerability affecting Next.js applications using the Pages Router and App Router. Linux and macOS deployments are not affected.

The second issue is an AVIF image processing vulnerability caused by a heap buffer overflow in the libheif library. A specially crafted AVIF image could potentially trigger code execution when processed by an affected Next.js application.

Affected versions include:

  • Next.js 13.4 through 15.5.23
  • Next.js 16.0 through 16.3.2

Fixed versions:

  • Next.js 15.5.24
  • Next.js 16.3.3

Vercel recommends upgrading immediately, especially for applications hosted on Windows. Vercel-hosted applications are protected and do not require an upgrade for these vulnerabilities.

No exploitation of either vulnerability had been reported as of August 27, 2026.