Ethical Hacking News
Next.js has released security patches for two critical-severity vulnerabilities in its web framework, both of which enable unauthenticated remote code execution. The vulnerabilities, CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4, affect Next.js versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2, and all libheif versions through v1.23.1, respectively. The patches aim to address these critical-severity vulnerabilities and prevent unauthenticated remote code execution in Next.js applications.
Vercel has released security patches for two critical-severity vulnerabilities in Next.js, enabling unauthenticated remote code execution. The first vulnerability affects Next.js applications using the Pages Router and App Router without Cache Components, while the second is related to AVIF image optimization. Users of Next.js 13.4 through 15.5.23 and versions 16.0 through 16.3.2 are at risk of being exploited. Regular security updates and developer vigilance are crucial to address these concerns. No exploitation of either August vulnerability had been reported as of August 27, 2026.
The web development landscape is under constant scrutiny, as vulnerabilities and security breaches continue to plague the industry. In the latest salvo in this ongoing battle, Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which enable unauthenticated remote code execution. The first of these vulnerabilities, CVE-2026-75604, affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server utilizes a Windows filesystem. Linux and macOS deployments are not impacted by this flaw. As a result, users of Next.js 13.4 through 15.5.23 and versions 16.0 through 16.3.2 are at risk of being exploited.
The second vulnerability, GHSA-2xp9-vwfh-vxw4, is related to AVIF image optimization. Next.js uses the sharp image processing package to optimize images, which in turn relies on the libheif C library to parse AVIF files. A critical heap buffer overflow in libheif can lead to remote code execution when Next.js processes an attacker-controlled AVIF image. The underlying vulnerability, GHSA-g89c-p67h-r497, involves a heap buffer overflow in the library's image scaling code. All libheif versions through v1.23.1 are affected, and the AVIF advisory covers Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2.
The attack mechanism for the Windows vulnerability was not disclosed in the advisory. However, Vercel's changelog credited the researchers evolutionstorm and B0RI with the responsible disclosure of the Windows vulnerability. The libheif maintainers disclosed the underlying vulnerability, which involves a heap buffer overflow in the library's image scaling code. All libheif versions through v1.23.1 are affected, and the AVIF advisory covers Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2.
The AVIF image optimization flaw was also exploited, allowing attackers to execute arbitrary code. The proof-of-concept demonstrates the out-of-bounds write, and the researchers' claim of remote code execution on multiple applications has not been independently corroborated. Next.js enables AVIF optimization only when a site explicitly adds image/avif to the formats configuration in next.config.js. Deployments without that configuration are not exposed to this flaw.
The patched Next.js releases turn off AVIF optimization entirely until the upstream fix propagates from libheif. The Hacker News confirmed on August 27, 2026, via the libheif GitHub releases page that v1.23.2 had not been published. Vercel had scheduled the August patches for August 26 as part of its monthly security cadence, but moved the release forward by one day after discovering an additional critical-severity vulnerability in one of its upstream dependencies.
This latest vulnerability highlights the importance of regular security updates and the need for developers to stay vigilant. Vercel's formal monthly security program, which the company announced in July 2026, aims to address these concerns. The first scheduled release, published on July 21, addressed nine vulnerabilities in Next.js 16.2.11 and 15.5.21, covering denial-of-service, server-side request forgery, and middleware bypass classes.
Users already on those July patches still need the August upgrade. Next.js has seen a run of critical security disclosures over the past two years, including a critical middleware bypass flaw in March 2025 that allowed unauthenticated attackers to skip authorization checks in self-hosted deployments. The React2Shell deserialization flaw in React Server Components, disclosed in December 2025, carried a CVSS score of 10.0 and was actively exploited within hours of public disclosure.
No exploitation of either August vulnerability had been reported as of August 27, 2026. However, the importance of addressing these vulnerabilities cannot be overstated. The libheif advisory credited rootxharsh as Finder and KarimPwnz as Coordinator, but Vercel's changelog attributed the disclosure to the Hacktron team. The researchers released a full Python proof-of-concept alongside the libheif disclosure that reproduces the heap corruption under an address sanitizer build.
The vulnerability affects all libheif versions through v1.23.1, and the AVIF advisory covers Next.js versions 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2. The patched Next.js releases turn off AVIF optimization entirely until the upstream fix propagates from libheif. The Hacker News confirmed on August 27, 2026, via the libheif GitHub releases page that v1.23.2 had not been published. Vercel had scheduled the August patches for August 26 as part of its monthly security cadence, but moved the release forward by one day after discovering an additional critical-severity vulnerability in one of its upstream dependencies.
Related Information:
https://www.ethicalhackingnews.com/articles/Unauthenticated-Remote-Code-Execution-The-Critical-AVIF-and-Windows-Flaws-in-Nextjs-ehn.shtml
https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
https://nvd.nist.gov/vuln/detail/CVE-2026-75604
https://www.cvedetails.com/cve/CVE-2026-75604/
Published: Sat Aug 29 19:36:57 2026 by llama3.2 3B Q4_K_M
