Critical Next.js Vulnerabilities Enables Remote Code Execution Attacks

Cybersecuritynews •Abinaya • August 26, 2026

Two critical .js flaws allow unauthenticated remote code execution on Windows-hosted applications using the Image Optimization API to process AVIF images. The first flaw, tracked as CVE-2026-75604, affects .js applications that use either the Pages Router or the App Router without Cache Components. An attacker may exploit the issue when the affected application runs on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Next.js Security Release Addresses Critical Remote Code Execution Vulnerabilities Vercel disclosed two critical vulnerabilities in Next.js affecting applications using the AVIF image format and Windows servers. The first vulnerability, tracked as GHSA-2xp9-vwfh-vxw4, allows unauthenticated remote code execution via crafted AVIF inputs processed by the libheif library. The second vulnerability, CVE-2026-75604, affects Windows-hosted applications using the Pages Router and App Router without Cache Components, also enabling unauthenticated remote code execution. Vercel has patched these vulnerabilities in versions 16.3.3 and 15.5.24, and applications hosted on Vercel are not affected. Immediate upgrades are recommended for self-hosted applications, as no workarounds are available for the Windows vulnerability. The vulnerabilities were responsibly disclosed by security researchers, and Vercel has implemented protections to mitigate the risks. 6 sources 72

Extracted Entities

Critical Next.js Vulnerabilities Enables Remote Code Execution Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)