Next.js CVE-2026-75604: Critical Windows RCE and AVIF Image Optimizer RCE Patched in Emergency Release
Two Critical Next.js Vulnerabilities Patched in Emergency Release
On August 25, 2026, Vercel pushed an accelerated security release for Next.js after engineers discovered two unrelated critical-severity vulnerabilities that both allow unauthenticated remote code execution. The release was originally scheduled for later in the month but was moved up when an additional flaw was found in an upstream dependency during the disclosure window.
CVE-2026-75604: Windows Path Traversal RCE
The first vulnerability, tracked as CVE-2026-75604 (CVSS 3.1: 9.0), is a Windows-specific path traversal flaw affecting Next.js applications deployed on Windows filesystems that use both the Pages Router and App Router without Cache Components enabled. The vulnerability exists because Windows and POSIX filesystems interpret path separators and reserved characters differently, and Next.js's routing logic did not fully account for that divergence when applications combined both routing systems.
The result: an unauthenticated attacker can traverse the filesystem and achieve remote code execution on the server. There is no workaround. A proof-of-concept exploit was published on GitHub within hours of the advisory, making rapid scanning and exploitation attempts highly likely.
GHSA-2xp9-vwfh-vxw4: AVIF Image Optimizer RCE
The second vulnerability, tracked as GHSA-2xp9-vwfh-vxw4 (CVSS 4.0: 9.5), traces to a heap buffer overflow in the libheif library that Next.js consumes through the sharp image-processing dependency. When the Image Optimization API decodes an attacker-supplied AVIF image, the overflow can be triggered to achieve unauthenticated remote code execution. This is a supply-chain issue — the vulnerable code lives in libheif, not in Next.js itself, but Next.js inherits the exposure because its Image Optimization API accepts external image URLs.
Affected Versions
- CVE-2026-75604: Next.js ≥ 13.4 and < 15.5.24, or ≥ 16.0 and < 16.3.3 (Windows only)
- GHSA-2xp9-vwfh-vxw4: All versions using the Image Optimization API with AVIF support
Both issues are fixed in Next.js 15.5.24 and 16.3.3. With roughly 45 million weekly npm downloads, Next.js is one of the most widely deployed web frameworks, making these vulnerabilities a high-priority patch target for any organization running affected versions.
Cloudflare WAF Response
Cloudflare issued an emergency WAF release on August 26 to protect customers running vulnerable Next.js versions. The release updated an existing Next.js RCE rule to identify CVE-2026-75604 and added a new detection rule for the AVIF Image Optimizer RCE. Both rules are set to Block in the Cloudflare Managed Ruleset.
What Should You Do?
- Patch immediately. Upgrade to Next.js 15.5.24 or 16.3.3 depending on your major version branch. Treat this as an emergency release.
- Audit Windows deployments. If you run Next.js on Windows with both Pages Router and App Router, you are directly exposed to CVE-2026-75604. Prioritize these deployments first.
- Restrict Image Optimization input. If you cannot patch immediately, restrict the Image Optimization API to only process images from trusted, allowlisted remote domains.
- Enable WAF protection. If you use Cloudflare, ensure the Managed Ruleset is enabled with the latest rules. If you run your own WAF, add detection for path traversal patterns targeting Next.js routes and AVIF image payloads to the optimizer endpoint.
- Monitor for exploitation. Check server logs for unusual requests to
/_next/imageendpoints and unexpected file path patterns in Next.js routing requests.
