Two critical vulnerabilities in Next.js – remote code execution on Windows

In its August update, Vercel is patching two critical vulnerabilities in .js that can occur during image optimization in AVIF format and on Windows servers. Both open up opportunities for attackers to execute code, thereby stealing data or causing damage to the system.

The AVIF vulnerability, rated 9.8 out of 10, originates from the libheif library used by .js . It allows a buffer overflow in the heap of all applications that use the heif_decode_image() method of the library.

The second vulnerability, rated 9 points and with CVE number CVE-2026-75604 , affects .js installations on Windows that use Pages and App routers without a cache component. There is no workaround for this vulnerability, and users should update to the latest versions immediately. Versions before 15.5.24 and 16.3.3 are impacted. An update can be performed with:

The version hosted by Vercel is not impacted, according to the manufacturer , as it does not offer AVIF optimization and runs on Linux. Vercel switched in July to a regular monthly update frequency.

Agentic AI brings a new dynamic to web development. Learn on October 22, 2026 at the online conference enterJS Agentic where agents shine or stumble, how to balance costs and benefits, and what questions only become visible when AI is used in practice. Discounted Blind-Bird tickets are available until the program is published.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.