Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both enabling unauthenticated remote code execution. One flaw can be exploited through specially crafted AVIF image files, while the other involves a path traversal vulnerability targeting servers running on Windows filesystems. The fixes became available on August 25, 2026, in Next.js 15.5.24 and 16.3.3, one day ahead of Vercel's planned monthly security release schedule.
The Windows path traversal flaw, designated CVE-2026-75604, earned a CVSS score of 9.0 and impacts Next.js applications using either the Pages Router or App Router without Cache Components when hosted on Windows-based servers. Linux and macOS environments face no exposure. Affected versions span from 13.4 through 15.5.23 and from 16.0 through 16.3.2. The AVIF image processing vulnerability, tracked as GHSA-2xp9-vwfh-vxw4 with a CVSS v4 score of 9.5, stems from a heap buffer overflow in the libheif C library that Next.js relies on through the sharp image processing package. This flaw affects all Next.js versions from 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2, but only deployments that explicitly enable AVIF optimization by adding image/avif to the formats configuration face risk.
According to Vercel's advisory, "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." Applications hosted directly on Vercel's platform are protected from both vulnerabilities and require no manual upgrade. The researchers credited with discovering the vulnerabilities—evolutionstorm and B0RI for the Windows flaw, and rootxharsh and KarimPwnz for the AVIF issue—released a full Python proof-of-concept demonstrating the heap corruption. "We were able to get RCE using this on multiple applications," the researchers stated in the libheif advisory, though independent verification of the remote code execution claim had not been published as of August 27, 2026.
The AVIF vulnerability exploits how libheif handles nested identity-derivation and auxiliary item references in crafted image files. When processing such a file, the library constructs a decoded image containing two Alpha plane entries at different bit depths. The scaler allocates a destination buffer sized for the first 8-bit Alpha entry but then writes 16-bit sample values from the second entry into that same buffer, overwriting roughly 16,384 bytes beyond the allocation boundary. The patched Next.js releases disable AVIF optimization entirely until the upstream fix from libheif becomes available; as of August 27, 2026, libheif v1.23.2 had not been published. Vercel accelerated its August security release by one day after identifying the additional critical-severity vulnerability in an upstream dependency. This August release marks the second under Vercel's formal monthly security program launched in July 2026, driven by what the company described as "the volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery."
Users already on the July patches—which addressed nine vulnerabilities including denial-of-service, server-side request forgery, and middleware bypass issues—still need to apply the August upgrade. No active exploitation of either August vulnerability had been reported as of August 27, 2026, though Next.js has experienced a series of critical security disclosures over the past two years, including a March 2025 middleware bypass allowing authorization check evasion and the React2Shell deserialization flaw in December 2025, which carried a perfect 10.0 CVSS score and saw active exploitation within hours of public disclosure. Affected users can upgrade by running npm install next@15.5.24 for the 15.5 line or npm install next@16.3.3 for the 16.3 line. The convergence of automated vulnerability discovery and monthly patch cycles signals a shift toward continuous security vigilance rather than reactive firefighting. Organizations relying on framework abstractions must now balance the convenience of managed services against the operational burden of staying current with an accelerating patch tempo.