Critical Next.js flaws allow remote code execution, Windows servers affected

Vercel has fixed two critical vulnerabilities in the Next.js JavaScript framework with its August update. Both flaws allow attackers to execute code on affected systems, potentially to steal data or compromise servers.

npm install next@15.5.24 # for 15.5
npm install next@16.3.3 # for 16.3

The first vulnerability, rated 9.8 out of 10 on the CVSS scale, originates from the libheif library that Next.js uses for image optimization. It causes a heap buffer overflow in any application calling the library's heif_decode_image() method when processing AVIF images.

The second flaw, rated 9 out of 10 and tracked as CVE-2026-75604, affects Next.js installations running on Windows servers that use the Pages and App Router without a cache component. According to Vercel there is no workaround for this vulnerability. Affected versions are all releases before 15.5.24 and 16.3.3, and users are urged to update immediately.

The Vercel-hosted variant of Next.js is not affected, the company states, because it does not offer AVIF optimization and runs on Linux. Vercel switched to a monthly release cadence for security updates in July.