Next.js CVE-2026-75604: Unauthenticated RCE on Windows Plus an AVIF Heap Overflow — Emergency Patches from August 25

> TL;DR: Two critical vulnerabilities patched in Next.js on August 25, 2026, both enabling unauthenticated remote code execution. CVE-2026-75604 (CVSS 9.0) is a path traversal that only affects servers hosted on a Windows filesystem — with no workaround available. The second (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) is a heap buffer overflow in libheif, the C library that parses AVIF images through sharp: a single malicious image can corrupt the Node process heap. Fixed versions are 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS). Apps deployed on Vercel are not affected.

Two distinct vectors, one reflex: upgrade

CVE-2026-75604 — Windows path traversal. The flaw affects applications using the Pages Router or the App Router (without Cache Components) when the production server runs on a Windows filesystem. Linux and macOS are not affected. Affected versions span 13.4 through 15.5.23 and 16.0 through 16.3.2. Vercel's advisory is blunt: there is no known workaround for Windows-hosted applications, upgrading is the only option. The flaw was responsibly disclosed by researchers evolutionstorm and B0RI.

The AVIF heap overflow. Next.js optimizes images through the sharp package, which relies on the C library libheif to decode AVIF. A forged AVIF file containing nested identity-derivation and auxiliary item references pushes libheif to build a decoded image with two Alpha planes at different bit depths: the scaler allocates a buffer sized for the first (8-bit) plane, then writes 16-bit samples from the second into it — a heap overflow of roughly 16,384 bytes past the allocation boundary. Researchers rootxharsh and KarimPwnz (Hacktron team) published a full Python proof-of-concept and state they achieved RCE on multiple applications.

Important nuance: AVIF optimization is only active if your configuration explicitly adds image/avif to the formats key in next.config.js. Without that line, the AVIF surface is closed. The patched releases go further and disable AVIF optimization entirely until the upstream libheif fix (all versions through 1.23.1 are affected) propagates — as of August 27, v1.23.2 had not been published.

Why this matters to you

The Windows window is narrow in French SaaS (most self-hosted Next.js deployments run on Linux), but two points deserve attention. First, the image optimization chain by definition processes files supplied by your users — a classic unauthenticated input, relying on native C code (libheif) where memory corruption turns into code execution. Second, Vercel now runs a formal monthly security program: this is the second scheduled release, moved forward by a day after an additional critical flaw was found in an upstream dependency. The July release had already fixed nine vulnerabilities (DoS, SSRF, middleware bypass) — being current in July does not cover August.

What to do

The broader lesson: your image pipeline is exposed native code

Most teams treat image optimization as a convenience feature. Technically, it is a C parser fed by public input, wired directly into your web application process. The sharp/libheif stack is healthy and well maintained — which is exactly why it is everywhere, and why one flaw in it exposes thousands of applications at once. If your product accepts files from users (profile photos, documents, resumes), your attack surface includes these native libraries and their memory-safety history. An audit that only tests the HTTP layer (auth, authorization, business logic) misses this risk class: upload fuzzing and file-processing chain verification belong in scope.