Two critical Next.js flaws allow unauthenticated remote code execution on Windows-hosted applications using the Image Optimization API to process AVIF images.
The first flaw, tracked as CVE-2026-75604, affects Next.js applications that use either the Pages Router or the App Router without Cache Components.
An attacker may exploit the issue when the affected application runs on a server using a Windows filesystem. GitHub classified the flaw as critical and linked it to CWE-22, also known as path traversal.
This weakness occurs when an application uses attacker-controlled input to construct a file path but fails to restrict special path elements adequately. As a result, a crafted request may cause the application to access locations outside its intended directory.
The vulnerability has a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Although the GHSA-p293-qw3h-jr36 advisory rates the attack complexity as high, exploitation can be performed remotely without authentication or user interaction.
A successful attack could expose sensitive data, alter server-side content, or disrupt application availability. Affected versions include Next.js releases from 13.4 through 15.5.24, and from 16.0 through 16.3.3, but not including 15.5.24 or 16.3.3.
Next.js Vulnerabilities
Vercel fixed the issue in Next.js 15.5.24 and 16.3.3. There is currently no workaround for affected applications hosted on Windows, making an immediate upgrade the recommended mitigation.
A second critical advisory, GHSA-2xp9-vwfh-vxw4, affects Next.js Image Optimization API deployments that optimize AVIF files.
The issue stems from the underlying libheif library used by the Sharp image-processing package. Next.js relies on Sharp to resize, convert, and optimize images served by applications.
An attacker could potentially submit a malicious AVIF image to a vulnerable image optimization endpoint. If processed by the affected libheif component, the file could trigger remote code execution on the server.
The advisory assigns a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, indicating high potential impact across confidentiality, integrity, and availability.
The AVIF-related flaw affects Next.js versions from 10.0.0 through versions before 15.5.24, as well as releases before 16.3.3. The issue was resolved in the same patched versions: 15.5.24 and 16.3.3.
Until the dependency fix propagated, Next.js disabled AVIF optimization as a protective measure. However, organizations should not rely only on this behavior.
Administrators should update deployed Next.js applications, rebuild production containers, refresh dependency lockfiles, and verify that active workloads are running patched releases.
Security teams should also review public image upload paths, exposure of the Next.js Image Optimization API, Windows-hosted production instances, and logs for unusual requests involving traversal patterns or AVIF processing. The advisories were reported by researchers using the handles evolutionstorm and B0RI.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
