Critical Next.js RCE: Is Your App Vulnerable?

Your Next.js app might have an unauthenticated remote code execution vulnerability right now, and you may not even know it. Last week, Vercel patched two critical vulnerabilities in Next.js — both allow remote code execution without authentication. No login needed. No user interaction required. If you're running an affected version on a public endpoint, an attacker can reach these code paths today.

This post walks through what each vulnerability is, which versions are affected, and exactly what you need to do to secure your deployment. Don't skim this one — read the upgrade checklist at the end and act on it.

Two Critical Next.js RCE Vulnerabilities — Patched August 25, 2026

On August 25, 2026, Vercel shipped a security release for Next.js that addresses two distinct remote code execution flaws. Both are unauthenticated, meaning an attacker does not need credentials or any prior session with your application to exploit them. The only mitigation is upgrading.

The first, tracked as CVE-2026-75604, is a path traversal vulnerability specific to Windows-hosted Next.js servers. It affects Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2 when running on Windows filesystems, and it impacts deployments using both the Pages Router and the App Router (as long as Cache Components are not enabled). Critically, there is no workaround for this issue — the only fix is to upgrade immediately.

The second, tracked as GHSA-2xp9-vwfh-vxw4, is a heap buffer overflow in libheif, the library used by sharp for AVIF image decoding in Next.js's built-in image optimizer. It affects Next.js 10.0 through 15.5.23 and 16.0 through 16.3.2. An attacker submits a malicious AVIF image to your /_next/image endpoint, which triggers the overflow and results in code execution on your server. Because the image optimization API is publicly reachable by default, this is a low-effort, high-impact attack.

CVE-2026-75604 — Path Traversal on Windows

The path traversal vulnerability lives in Next.js's incremental cache. When the cache resolves a key, a crafted cache key can cause it to resolve a path outside the intended cache directory. On Windows specifically, the way the runtime handles path separators allows an attacker to read or write files outside the cache root. From there, the attacker can influence server-side files that the application later executes — for example, by overwriting a cached module or configuration file that gets loaded into the Node.js process.

The end result is unauthenticated remote code execution on any Windows-hosted Next.js server running an affected version. This is not a theoretical issue; the path separator handling on Windows is the concrete mechanism that makes exploitation possible, which is why Linux-hosted deployments are not affected by this specific CVE.

The fix is straightforward: upgrade to Next.js 15.5.24 or 16.3.3 immediately. There is no configuration change, feature flag, or middleware workaround that mitigates this. If your production server runs on Windows and you're on an affected version, treat this as a P0 incident.

AVIF libheif Heap Buffer Overflow

The second vulnerability is in the image optimization pipeline. Next.js's image optimization uses the sharp package, which in turn relies on the libheif library to decode AVIF files. A carefully crafted AVIF file can trigger a heap buffer overflow inside libheif, and a heap overflow in an image decoder is a well-known path to arbitrary code execution.

The attack vector is alarmingly simple: send a malicious AVIF image URL to the /_next/image optimization API. That's the entire exploit. No authentication is required because the image optimization endpoint is designed to be called by the browser with arbitrary src parameters, and there is no built-in allowlist on the AVIF decoder path.

The fix is to upgrade to Next.js 15.5.24 or 16.3.3. The patched releases take a defensive measure on top of the version bump: they disable AVIF optimization entirely until a fixed libheif version is available. Do not attempt to re-enable AVIF optimization manually until the upstream libheif fix ships and Next.js re-enables it in a future release.

Your Upgrade Checklist

Work through this list in order. If you're on an affected version, treat steps 1–3 as urgent.

First, check your current version:

npx next --version

If the output shows a version in the range 13.4 through 15.5.23, or 16.0 through 16.3.2, you are affected by at least one of these vulnerabilities. Upgrade now to 15.5.24 (if you're on the 15.x line) or 16.3.3 (if you're on the 16.x line):

npm install next@16.3.3

If your server runs on Windows, there is no workaround for CVE-2026-75604 — patch before you do anything else. Do not delay this behind other work, and do not assume a reverse proxy or WAF rule will protect you, because the vulnerable code path is reachable through normal Next.js runtime behavior.

After upgrading, be aware that AVIF optimization is disabled in the patched releases. Don't re-enable it until libheif is fixed and a subsequent Next.js release restores support. Other image formats (WebP, PNG, JPEG) continue to work normally.

Before redeploying, run an audit and rebuild your dependency tree to make sure no transitive copies of the vulnerable version remain:

npm audit
npm run build

Finally, check your /_next/image access logs for unusual AVIF request URLs. Look for requests with .avif extensions or format=avif parameters coming from unexpected sources, repeated requests to the same suspicious URL, or requests with abnormally large or malformed src values. If you find indicators of prior exploitation, assume compromise and investigate the host for post-exploitation artifacts — a successful RCE means an attacker could have established persistence on the server.

Conclusion

These two vulnerabilities are critical, unauthenticated, and actively disclosed. The path traversal issue gives attackers code execution on Windows-hosted Next.js servers with no workaround, and the AVIF decoder overflow turns your image optimization endpoint into a remote code execution surface. Neither requires credentials, and both are reachable on default deployments. The only meaningful response is to upgrade to Next.js 15.5.24 or 16.3.3 and verify your logs. Don't wait on this one.

Need help with this?

Get in touch — I take on a few new clients each month.