Next.js CVE-2026-75604 is a critical, unauthenticated remote code execution flaw (CVSS 9.0) affecting Next.js applications served from a Windows filesystem, and Vercel has patched it alongside a second critical RCE triggered by malicious AVIF images. CVE-2026-75604 is a path traversal issue that affects apps using both the Pages Router and App Router without Cache Components when the server runs on Windows; Linux and macOS deployments are not affected. The fixes are in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published August 25, 2026, and there is no workaround for affected Windows-hosted applications, so upgrading is the only option.

Next.js is one of the most widely deployed web frameworks, which makes an unauthenticated RCE broadly relevant, especially to the startups and small teams that reach for it by default. The flaw affects Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2. Applications hosted on Vercel are protected and need no upgrade, but self-hosted Windows deployments carry the full risk. Vercel credited researchers evolutionstorm and B0RI with the responsible disclosure.

Which Next.js versions are affected and how do I upgrade?

Upgrade to a patched release: run npm install next@15.5.24 for the 15.5 line or npm install next@16.3.3 for the 16.3 line. The Windows path traversal is the one with no workaround, so Windows-hosted apps should treat the upgrade as urgent.

Why is the AVIF flaw a supply-chain lesson?

Because the vulnerability is not really in Next.js code. Next.js uses the sharp image package to optimize images, sharp relies on the libheif C library to parse AVIF files, and a heap buffer overflow in libheif is what enables code execution when Next.js processes an attacker-controlled AVIF image. That is a dependency-of-a-dependency turning into an unauthenticated RCE in your app, a textbook reminder that your attack surface includes every transitive library you never chose directly. Teams that maintain a software bill of materials can answer "are we exposed" far faster than teams that do not.

Our read

An unauthenticated RCE in a default-choice framework, made worse by a buried image-parsing dependency, is exactly the risk profile of modern AI-accelerated development: code assembled quickly from many components, most of them someone else's. This ties to how we think about understanding risk, because the exposure here is inherited, not authored, and you cannot patch what you have not inventoried. Upgrade the framework, yes, but also track your dependencies continuously, since the next libheif-style flaw will surface in a package you did not know you shipped.

Reporting by The Hacker News; CVSS and affected-version detail per the Vercel advisory and GitHub Security Advisories. Sources linked above.

Related: Code security for SMBs: packages, APIs, and SBOMs and Vibe coding security.