Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has patched two critical vulnerabilities in Next.js that permit unauthenticated remote code execution on affected applications. Both flaws carry CVSS scores of 9.8, placing them at the highest severity tier.

The first vulnerability exploits specially crafted AVIF image files. When a Next.js application processes a malicious AVIF image, an attacker bypasses authentication entirely and executes arbitrary code on the server. AVIF, a modern image format gaining adoption for its compression efficiency, becomes an attack vector when Next.js handles image optimization without proper validation. Attackers craft poisoned images that trigger code execution during the optimization pipeline.

The second flaw, CVE-2026-75604, affects Next.js deployments running on Windows filesystems. A path traversal vulnerability allows unauthenticated attackers to escape directory boundaries and access restricted files or execute code. Windows path handling differs from Unix-like systems, often using backslashes and case-insensitive paths. Next.js fails to properly sanitize path inputs on Windows, enabling attackers to traverse directories upward using "../" sequences or alternate path representations. An attacker exploits this to read sensitive configuration files, environment variables containing secrets, or overwrite application logic.

Both vulnerabilities demand immediate patching. Organizations running Next.js in production must prioritize updates to the latest patched version. The unauthenticated nature of these flaws means attackers need no valid credentials, no user interaction, and no network access restrictions to trigger exploitation. A public-facing Next.js application becomes immediately compromised if unpatched.

The AVIF vulnerability poses particular risk for applications using Next.js image optimization features in production. Many developers enable automatic image optimization to improve performance, often processing user-uploaded files or externally sourced images. A single malicious image upload, advertisement, or social media embed can compromise the entire server.

The Windows path traversal flaw specifically targets organizations deploying Next.js on Windows servers, a practice more common in enterprise environments with existing Windows infrastructure. Container deployments using Windows Server as the base image also remain vulnerable until patched.

Vercel recommends upgrading to Next.js versions that address both issues. Users should verify their current version against Vercel's security advisory and apply patches immediately. For organizations unable to patch immediately, deploying Next.js behind a Web Application Firewall that blocks requests with malicious AVIF headers or suspicious path sequences provides temporary mitigation. Disabling automatic image optimization temporarily reduces the AVIF attack surface until patches deploy.

The timing of these disclosures highlights the expanding attack surface of popular web frameworks. As Next.js adoption grows across enterprise deployments, framework-level vulnerabilities demand attention from security teams. Both flaws bypass traditional authentication controls entirely, making them particularly dangerous for production systems.

Organizations should review their Next.js deployments today, prioritize patching, and monitor server logs for signs of exploitation attempts. The combination of high severity, unauthenticated access, and remote code execution leaves no room for delayed remediation.