🔴 Critical: Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
-
Vercel has shipped security updates for two critical-severity flaws in the Next.js web framework, both enabling unauthenticated remote code execution under specific conditions. The first issue is triggered by specially crafted AVIF image files, while the second is a path traversal vulnerability affecting deployments running on Windows filesystems.
The Windows path traversal bug, tracked as CVE-2026-75604, allows an attacker to escape the intended directory restrictions and execute arbitrary code without authentication. This is particularly dangerous for organizations hosting Next.js applications on Windows servers, as it could lead to full system compromise if exploited.
The AVIF-related vulnerability, meanwhile, stems from improper handling of image metadata during parsing. By submitting a malicious AVIF file, an unauthenticated remote attacker can achieve code execution on the server. This vector is especially concerning given how common image upload and processing features are in modern web applications.
- Affected versions: Prior to the latest patched releases for both vulnerabilities.
- Patched versions: Upgrade to the newest Next.js release that includes these fixes.
- Impact: Unauthenticated remote code execution, potential full server takeover.
- Mitigation: Apply the official patches immediately, and restrict access to image upload endpoints if possible.
As always, prioritize updating production instances without delay, and verify your current version against the latest release notes. If you run Next.js on Windows, treat this as an urgent action item.
Source: The Hacker News
Is your team already running the patched Next.js version, and have you reviewed any custom image processing pipelines for exposure to the AVIF flaw?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login