45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated Remote Code Execution

by

Author: Do Son (SecurityOnline.info)
Published: August 26, 2026
Source: https://securityonline.info/nextjs-rce-vulnerability/

Summary

Vercel has patched two critical, unauthenticated remote code execution flaws in Next.js, the widely used full-stack JavaScript framework. The primary bug, CVE-2026-75604 (CVSS 9.0), is a Windows-only path traversal that can lead to RCE; a second flaw in the image-optimization path (CVSS 9.5) allows code execution via crafted AVIF images. With Next.js seeing more than 45 million weekly npm downloads, the article stresses rapid patching. As reported, neither issue has confirmed in-the-wild exploitation and no public proof-of-concept exists yet. This is a vulnerability-disclosure news report rather than an exploit writeup; details are attributed to Vercel’s advisories.

Technical Details

The two flaws are independent:

  • CVE-2026-75604 — Windows path traversal → RCE (CVSS 9.0). Per Vercel, this affects deployments hosted on machines using a Windows filesystem, in apps using the Pages and App router without Cache Component. A path-traversal condition lets an attacker escape intended directory boundaries, which on affected Windows hosts can be leveraged to remote code execution. It requires no authentication.
  • AVIF image-optimization flaw (CVSS 9.5). This resides in the image optimization API and originates in the libheif library used by the sharp image-processing tool. When an AVIF file is optimized, a maliciously crafted AVIF image can trigger code execution on the server. Because it stems from the underlying image parser, it is not tied to the Windows-only precondition of the first bug.

The article does not include exploit code or step-by-step exploitation details, and no public PoC is available. Verichains-style low-level analysis is not part of this report — it is a summary of the two advisories and their impact.

Impact

Both bugs are unauthenticated and rated critical, giving attackers a low bar to full server compromise on affected, unpatched deployments. The Windows RCE is gated by platform and router configuration (Windows filesystem host; Pages/App router without Cache Component), so it does not affect every Next.js install — notably typical Linux-hosted deployments are outside its stated scope. The AVIF flaw is broader in version range and affects any deployment that optimizes attacker-supplied AVIF images. Given Next.js’s ~45M weekly downloads and use by large organizations, the aggregate exposure is significant.

Affected versions as stated by the source: the Windows RCE (CVE-2026-75604) affects 13.4 up to 15.5.24 and 16.0 up to 16.3.3; the AVIF flaw affects 10.0.0 up to 15.5.24 and versions below 16.3.3.

Mitigation

Upgrade to a fixed Next.js release — 15.5.24 (for the 13.x–15.x line) or 16.3.3 (for the 16.x line) — which are the patched versions the “up to” ranges above stop at; upgrade immediately. There is no workaround for the Windows RCE flaw, so patching is the only remedy there. As an interim measure for the image bug until you can patch, disable AVIF optimization. Review Vercel’s official GitHub Security Advisories (linked in References) for the precise affected/fixed version boundaries and configuration conditions before acting, and prioritize any Windows-hosted Pages/App-router apps without Cache Component. Note the source phrases the affected ranges loosely; treat the linked advisories as authoritative.

References

Leave a Comment