Full research report

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Two independently discovered critical unauthenticated RCEs in Next.js were disclosed and patched simultaneously on 25 August 2026 in a pre-announced, coordinated release. CVE-2026-75604 (CVSS 9.0) is a Windows-specific path traversal in the filesystem cache layer with no workaround and a public PoC confirmed functional on Next.js 16.2.11 under specific router configurations. The AVIF flaw (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) is rooted in a heap buffer overflow in libheif ≤1.23.1 (GHSA-g89c-p67h-r497, CVSS 9.8), where crafted AVIF item graphs cause approximately 16,384 bytes of out-of-bounds heap writes; the researchers claim RCE on multiple applications, but this has not been independently verified. The patched Next.js releases disable AVIF optimisation as an interim mitigation pending libheif v1.23.2 propagation, and Fastly has deployed a WAF virtual patch for the Windows flaw. No active exploitation in the wild has been reported, but the combination of public PoC code, broad ecosystem reach, and no workaround for the Windows flaw makes this a high-priority patching event for any self-hosted Windows deployment.

What happened

On 25 August 2026, Vercel released patched versions of Next.js (15.5.24 and 16.3.3) to address two independently discovered critical unauthenticated RCE vulnerabilities. CVE-2026-75604 (CVSS 9.0) is a Windows-only path traversal flaw in the filesystem cache layer, reported by researchers evolutionstorm and B0RI. The second issue (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) stems from a heap buffer overflow in the upstream libheif library (GHSA-g89c-p67h-r497, CVSS 9.8), triggered when Next.js processes attacker-supplied AVIF images; rootxharsh and KarimPwnz are credited as finder and coordinator respectively. Vercel pre-announced the release and accelerated it after discovering the AVIF vulnerability.

Affected scope

CVE-2026-75604 affects Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2 on Windows-hosted servers only, requiring both Pages Router and App Router without Cache Components. The AVIF flaw affects the broader range of Next.js 10.0.0 through 15.5.23 and all 16.x releases through 16.3.2 on any operating system, as well as any application using libheif ≤1.23.1 directly. Applications hosted on Vercel's own platform are protected without upgrade; Netlify's Linux infrastructure and CDN image routing also remove both attack paths for hosted sites.

Technical assessment

CVE-2026-75604 involves improper neutralisation of path-separator characters (CWE-22) in Next.js's Windows filesystem cache, allowing an unauthenticated network request to escape intended directory boundaries and achieve code execution. The AVIF flaw chains through Next.js's use of sharp, which calls libheif to decode AVIF files: a specially crafted AVIF with nested identity-derivation (iden) and auxiliary (auxl) item references causes libheif's image scaler to allocate a buffer sized for an 8-bit alpha plane but write 16-bit sample data into it, overflowing approximately 16,384 bytes on the heap. The patched Next.js releases disable AVIF optimisation entirely as a mitigation pending propagation of the libheif v1.23.2 upstream fix.

Recommended defensive actions

  1. Patch Next.js immediately to 15.5.24 (for the 15.5 line) or 16.3.3 (for the 16.3 line) by running the appropriate npm install command and redeploying
  2. Inventory all Next.js deployments running on Windows infrastructure and treat CVE-2026-75604 as the highest-priority upgrade given the absence of any workaround
  3. Deploy a WAF virtual patch — such as Fastly's CVE-2026-75604 signal in block mode — as a temporary network-layer control where immediate code deployment is not possible
  4. Update libheif to v1.23.2 or later in any application stack that uses it independently of Next.js to address the upstream heap buffer overflow
  5. Monitor server logs and endpoint telemetry for anomalous AVIF upload requests to the image optimisation endpoint and Windows-specific path traversal sequences in HTTP request paths

Uncertainties and evidence gaps

  • CVE-2026-75604's precise exploitation mechanism was not publicly disclosed in the advisory; the GitHub PoC confirms unauthenticated RCE is achievable but exact trigger conditions require specific router configuration
  • The AVIF/libheif flaw carries no assigned CVE as of 27 August 2026 (GHSA identifiers only), which may delay detection and prioritisation in vulnerability management tooling that relies on CVE coverage
  • Researchers' claim of RCE on 'multiple applications' for the AVIF flaw has not been independently corroborated; heap corruption and out-of-bounds write are confirmed, but real-world RCE reliability under varied deployment configurations is unverified
  • The scale of internet-exposed Windows-hosted Next.js deployments meeting the exact vulnerable configuration for CVE-2026-75604 is not publicly quantified

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access; no credentials or prior session required for either vulnerability path
ComponentCVE-2026-75604: Next.js filesystem cache layer on Windows servers; AVIF flaw: Next.js Image Optimization API via the sharp/libheif dependency chain
MechanismCVE-2026-75604: Improper path normalisation on Windows allows a crafted HTTP request to resolve a cache path outside the intended directory boundary (CWE-22). AVIF flaw: Nested AVIF item-graph structures (iden/auxl references) cause libheif's image scaler to write 16-bit sample data into a buffer allocated for 8-bit data, overflowing approximately 16,384 bytes on the heap.
ImpactUnauthenticated remote code execution with the privileges of the Next.js server process on either vulnerability path
DetectionAnomalous AVIF file uploads to image optimisation endpoints; Windows-specific path separator sequences in HTTP request paths; unexpected child process spawning from the Next.js server process
MitigationUpgrade to Next.js 15.5.24 or 16.3.3; update libheif to v1.23.2 for the AVIF flaw; apply Fastly WAF virtual patch for CVE-2026-75604 where immediate patching is not feasible
Exploitation status

No confirmed active exploitation in the wild reported as of 27 August 2026; a public proof-of-concept for CVE-2026-75604 is available on GitHub, and researchers claim successful RCE in their own testing for the AVIF/libheif flaw, though this has not been independently corroborated.

Research process

The investigation began by reviewing and verifying the claims in the THN article, which cited two GitHub advisories as primary sources. Both Vercel advisories and the upstream libheif advisory were fetched directly to confirm affected version ranges, researcher credits, and exploitation claims. A third-party PoC for CVE-2026-75604 was confirmed on GitHub. Independent corroboration came from the official Next.js security blog, Netlify's hosting changelog, and a Fastly WAF virtual patch deployment — all consistent with the advisory details and pointing to a coordinated, pre-announced disclosure.

  1. What are the specific claims in the source article, and which URLs point to primary evidence?
    Fetched the THN article to extract CVE IDs, affected versions, patch versions, researcher credits, and advisory URLs
    thehackernews.com ↗

    Two critical RCEs described: CVE-2026-75604 (Windows, CVSS 9.0) and GHSA-2xp9-vwfh-vxw4 (AVIF/libheif, CVSS v4 9.5); patches in 15.5.24 and 16.3.3; advisory URLs for both GitHub advisories identified

    why Established the scope of claims requiring independent verification and surfaced the primary source URLs for direct fetching

  2. Is CVE-2026-75604 independently documented, and what does the vendor advisory specify?
    Searched for CVE-2026-75604 to locate corroborating sources, then fetched the GitHub advisory GHSA-p293-qw3h-jr36
    github.com ↗

    Confirmed affected version ranges (13.4–15.5.23, 16.0–16.3.2), CVSS 9.0, CWE-22 classification, no workaround available, researchers evolutionstorm and B0RI credited; search also surfaced a public PoC repository and a Fastly virtual patch

    why Vendor advisory confirmed the CVE's scope and severity; CWE-22 classification establishes the Windows-specific path-handling nature; search results revealed additional references requiring fetching

  3. Is a public proof-of-concept available for CVE-2026-75604, and what does it reveal about exploitability?
    Fetched the GitHub PoC repository identified in search results
    github.com ↗

    Functional PoC confirmed, validated on Next.js 16.2.11; requires Windows server with Pages Router, App Router, no Cache Components, and a compatible Server Action; unauthenticated

    why Confirms PoC availability and refines the exploitability assessment; the configuration requirements define the realistic attack surface more precisely than the advisory alone

  4. What is the root cause and scope of the upstream libheif vulnerability, and is a PoC available?
    Searched for GHSA-g89c-p67h-r497 and fetched the libheif security advisory
    github.com ↗

    Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items; all libheif ≤1.23.1 affected; CVSS 9.8; Python PoC (gen_poc.py) included; researchers state 'We were able to get RCE using this on multiple applications'; patched in v1.23.2

    why Establishes the upstream root cause, confirms a working PoC, and notes the researcher RCE claim — which must be carried as credible but unverified rather than confirmed

  5. What does the Next.js-specific AVIF advisory add, and has a CVE been assigned?
    Fetched the Next.js advisory GHSA-2xp9-vwfh-vxw4
    github.com ↗

    No CVE assigned as of the advisory date; CVSS v4 9.5; broader affected range (Next.js ≥10.0.0); mitigation is disabling AVIF optimisation in patched releases

    why Absence of a CVE is a material gap that may affect detection by vulnerability scanners; the mitigation approach (disabling AVIF) is notable as it trades functionality for security pending upstream propagation

  6. What is the official Vercel account of the release timeline and whether the disclosure was coordinated?
    Fetched the Next.js security blog post
    nextjs.org ↗

    Vercel pre-announced the release and accelerated it after discovering the AVIF flaw; both vulnerabilities addressed in 15.5.24 and 16.3.3 on 25 August 2026

    why Confirms coordinated disclosure with a pre-announcement window and an accelerated timeline driven by the upstream AVIF discovery — indicating responsible disclosure process followed

  7. Has an independent hosting provider assessed the real-world impact on hosted deployments?
    Fetched Netlify's changelog entry for the security release
    netlify.com ↗

    Netlify confirms its Linux infrastructure removes CVE-2026-75604 exposure entirely; image CDN routing mitigates AVIF flaw; upgrade still recommended for self-hosted users

    why Independent corroboration from a major hosting provider; confirms Windows-only scope of CVE-2026-75604 in real deployment terms and demonstrates platform-level mitigation approaches

  8. Has the security industry deployed operational network-layer controls for CVE-2026-75604?
    Fetched the Fastly documentation for a virtual patch targeting CVE-2026-75604
    fastly.com ↗

    Fastly released a WAF virtual patch in August 2026 covering CVE-2026-75604; operators can configure block or log mode depending on their platform tier

    why Rapid WAF virtual patch deployment by a major CDN provider signals industry-assessed severity and provides a documented short-term control for organisations unable to patch immediately

Named in this story
ActorsrootxharshKarimPwnzHacktronevolutionstormB0RI
TargetsWindows-hosted Next.js applicationsNext.js Image Optimization API users
Related CVEs CVE-2026-75604

Research coverage

All 71 registered source leaves were evaluated for this run: 64 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 63 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 71 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok11 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok11 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1685 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok8041 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit 42news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 8 opened outside the registered collection
References & evidence
Reporting-linked PoC claims1
https://github.com/rafabd1/CVE-2026-75604-poc github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

Technical references3
github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36 ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4 ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497 ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code2
CVE-2026-75604 PoC – rafabd1 github.com ↗

Public PoC for Windows path traversal RCE; validated on Next.js 16.2.11 with specific router configuration requirements

libheif GHSA-g89c-p67h-r497 – Python PoC (gen_poc.py) github.com ↗

Python PoC generator for AVIF heap buffer overflow; produces ASAN-detectable heap corruption; released alongside upstream advisory

Vendor & gov advisories5
GHSA-p293-qw3h-jr36 – Unauthenticated RCE on Windows-hosted servers (Next.js) github.com ↗

Official Vercel advisory for CVE-2026-75604; CVSS 9.0; credits evolutionstorm and B0RI; no workaround exists

GHSA-2xp9-vwfh-vxw4 – Unauthenticated RCE in Image Optimization API via AVIF (Next.js) github.com ↗

Vercel advisory for AVIF flaw; CVSS v4 9.5; no CVE assigned; credits Hacktron team (rootxharsh, KarimPwnz)

GHSA-g89c-p67h-r497 – Heap buffer overflow in libheif via duplicate Alpha planes github.com ↗

Upstream libheif advisory; CVSS 9.8; affects all versions ≤1.23.1; root cause of the Next.js AVIF flaw

August 2026 Security Release – Next.js Blog nextjs.org ↗

Official Vercel announcement covering both vulnerabilities; confirms accelerated release upon AVIF discovery

CVE-2026-75604 Virtual Patch – Fastly fastly.com ↗

WAF-level virtual patch from Fastly; supports block or log mode as a temporary control

Analysis & research2
Next.js August 2026 Security Release – Netlify Changelog netlify.com ↗

Independent hosting-provider analysis confirming Netlify deployments are unaffected due to Linux infrastructure and CDN routing

Next.js Patches Critical AVIF and Windows Flaws – The Hacker News thehackernews.com ↗

Secondary reporting with researcher attribution and mechanism detail; treated as untrusted input, used only as a lead source