The Windows path traversal bug, tracked as CVE-2026-75604, allows an attacker to escape the intended directory restrictions and execute arbitrary code without authentication. This is particularly dangerous for organizations hosting Next.js applications on Windows servers, as it could lead to full system compromise if exploited.

The AVIF-related vulnerability, meanwhile, stems from improper handling of image metadata during parsing. By submitting a malicious AVIF file, an unauthenticated remote attacker can achieve code execution on the server. This vector is especially concerning given how common image upload and processing features are in modern web applications.

• Affected versions: Prior to the latest patched releases for both vulnerabilities.
• Patched versions: Upgrade to the newest Next.js release that includes these fixes.
• Impact: Unauthenticated remote code execution, potential full server takeover.
• Mitigation: Apply the official patches immediately, and restrict access to image upload endpoints if possible.

As always, prioritize updating production instances without delay, and verify your current version against the latest release notes. If you run Next.js on Windows, treat this as an urgent action item.

Source: The Hacker News

Is your team already running the patched Next.js version, and have you reviewed any custom image processing pipelines for exposure to the AVIF flaw?