Next.js AVIF and Windows Flaws Enable Unauthenticated RCE

Key Takeaways

• Two independent critical flaws: Vercel's August 25, 2026 release addressed both CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4.
• Unauthenticated server compromise: successful exploitation can lead to remote code execution with confidentiality, integrity, and availability impact.
• Different exposure conditions: the first path depends on Windows plus a specific router configuration; the second depends on attacker-influenced AVIF processing through sharp and libheif.
• Emergency upgrade: fixed Next.js releases are 15.5.24 and 16.3.3. The Windows flaw has no known workaround.
• High scanning likelihood: public technical material, framework ubiquity, and no-authentication-required access make rapid reconnaissance and exploit development plausible.

Why the Two Flaws Must Be Triaged Separately

Next.js is widely deployed for server-rendered React applications, routing, and built-in image optimization. The Image Optimization API can resize, re-encode, and cache images obtained from remote or user-influenced locations, which places external input near server-side file and memory operations.

The August 2026 release was accelerated after an additional critical issue was identified in an upstream dependency. That issue was the AVIF decoding flaw; it was released alongside a Windows path traversal fix that was already queued.

Vulnerability Comparison

Both attack paths require no authentication and no user interaction. A successful exploit can compromise the affected server, but an inventory must evaluate the distinct platform and feature conditions shown above.

CVE-2026-75604: Windows Path Traversal to RCE

CVE-2026-75604 has a CVSS 3.1 score of 9.0 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H and maps to CWE-22, improper limitation of a pathname to a restricted directory.

The advisory describes affected applications as those that run on a Windows filesystem, use both the Pages Router and App Router, and do not enable Cache Components. Windows interprets path separators, drive letters, and reserved device names differently from POSIX systems. Under the vulnerable routing behavior, attacker-controlled path segments can escape the intended application directory and ultimately reach code execution.

GHSA-2xp9-vwfh-vxw4: AVIF Parsing to RCE

The second issue has a CVSS 4.0 score of 9.5 and begins in libheif's handling of crafted AVIF containers. The upstream advisory describes nested identity-derivation and auxiliary item references that can create duplicate alpha-plane entries with different bit depths, leading to out-of-bounds heap writes during image scaling.

Next.js reaches the vulnerable code through a dependency chain: the Image Optimization API invokes sharp, and sharp invokes libheif to decode AVIF input. A deployment that accepts attacker-influenced image URLs and has AVIF output enabled can therefore expose the memory-corruption primitive over the network without authentication.

The patched Next.js releases disabled AVIF optimization pending propagation of a corrected libheif build through the dependency chain. This reflects a supply-chain boundary: the vulnerable decoding logic is upstream rather than authored by the Next.js team.

Exposure Triage: Ask the Right Questions

1. Find the running versionRecord the exact Next.js version from the deployed artifact and runtime. Do not rely only on a developer workstation or an unbuilt manifest.
2. Identify the host platformDetermine whether each instance runs on Windows, Linux, macOS, a container, or a managed platform whose underlying execution environment is documented.
3. Map router usageCheck whether the application contains both Pages Router and App Router routes, and confirm the Cache Components setting.
4. Inspect image configurationDetermine whether AVIF is enabled, which remote image origins are permitted, and whether unauthenticated users can influence image URLs or upload content.
5. Trace transitive packagesInventory sharp and libheif builds packaged into the deployed application or platform image, not just direct dependencies.
6. Include indirect ownershipAsk vendors and managed-service owners about embedded Next.js applications that the security team does not deploy directly.

Immediate Response Actions

• Upgrade immediately: move affected production applications to Next.js 15.5.24 or 16.3.3 as appropriate.
• Prioritize Windows: treat CVE-2026-75604 as the highest-priority subset because no workaround is available.
• Disable AVIF when patching is delayed: remove AVIF optimization as an interim measure, then validate that the deployment no longer processes AVIF through the affected path.
• Apply edge defenses: use available CDN or WAF virtual patches for defense in depth while the application upgrade is completed.
• Rebuild and redeploy: produce fresh artifacts, invalidate vulnerable images and containers, confirm the running version, and test routing plus image optimization.
• Expand the inventory: include third-party, subsidiary, staging, preview, and vendor-managed Next.js deployments exposed to untrusted traffic.

Monitoring and Strategic Controls

Longer-term lessons

• Monitor transitive dependencies: software composition analysis should include native libraries used by direct packages, especially parsers for untrusted binary content.
• Track exposure by platform: mixed Windows and Linux fleets can have different vulnerability states even when application code is identical.
• Apply emergency patch SLAs: unauthenticated vulnerabilities in routine features such as routing and image processing warrant action outside a normal maintenance cycle.
• Preserve incident evidence: if telemetry suggests exploitation, isolate the system, retain volatile and disk evidence, rotate exposed secrets, and follow the incident-response plan.

CSA Resource and Control Alignment

This incident fits a recurring pattern: a widely deployed application platform exposes an unauthenticated path to code execution while public technical material accelerates scanning. CSA's analyses of Langflow path traversal and RCE issues describe comparable emergency-patching, least-exposure, and WAF-limitation concerns.

The response also aligns with the Threat and Vulnerability Management and Application and Interface Security domains of CSA's AI Controls Matrix v1.1. The relevant practices include dependency inventories, emergency patch processes, authentication boundaries, and input validation for internet-facing services. These controls matter even when Next.js is conventional web infrastructure supporting an AI-enabled product rather than an AI system itself.

References

1. The Hacker News: Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE.
2. Next.js: August 2026 Security Release.
3. Next.js advisory: unauthenticated RCE on Windows-hosted servers.
4. CVE Program: CVE-2026-75604.
5. Next.js advisory: unauthenticated RCE in the Image Optimization API when AVIF files are used.
6. libheif advisory: heap buffer overflow through duplicate alpha planes.
7. Fastly: virtual patch for CVE-2026-75604.
8. Cloudflare: emergency WAF release.
9. Cyber Security News: critical Next.js vulnerabilities.
10. Security Online: Next.js CVE-2026-75604 analysis.
11. Public CVE-2026-75604 proof of concept.
12. CSA: CVE-2026-5027 Langflow path traversal to unauthenticated RCE.
13. CSA: CVE-2026-33017 Langflow RCE.
14. Cloud Security Alliance: AI Controls Matrix v1.1.

Source note: This lesson adapts the supplied research note by the Cloud Security Alliance AI Safety Initiative, published August 28, 2026. The source stated that no active exploitation had been confirmed as of August 27, 2026; readers should verify current threat intelligence before making a present-day incident decision.

Download the original CSA research note (PDF)

Next.js AVIF and Windows RCE Frequently Asked Questions