Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Summary

Next.js has patched two critical RCE vulnerabilities: one in AVIF image processing via libheif, and another Windows path traversal flaw. Patched versions are 15.5.24 and 16.3.3. Vercel-hosted apps are protected. No exploitation reported yet.

Key Takeaways

1. Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution.
2. The Windows path traversal, tracked as CVE-2026-75604 (CVSS score: 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem.
3. A critical heap buffer overflow in libheif can lead to remote code execution when Next.js processes an attacker-controlled AVIF image (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5).

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article provides specific CVE numbers, CVSS scores, and version details, indicating a factual basis. It also cites researchers and Vercel advisories. However, it relies on a single source and mentions uncorroborated claims of exploitation.

Bias assessment: Technical Reporting. The article focuses on technical details of software vulnerabilities and their patches. It presents information objectively, using precise language and citing official advisories without adopting a particular political or ideological stance.

Note: This article details critical security vulnerabilities. Ensure your Next.js installations are updated to the patched versions to mitigate risks.

Credibility flag: Technical Security Alert

Claimed Facts (10)

• This is a direct statement of fact about the release of security patches and the nature of the vulnerabilities.
• This provides specific technical details about a vulnerability, including its CVE, CVSS score, and affected configurations.
• This is a factual statement clarifying the scope of the Windows path traversal vulnerability.
• This states the specific versions of Next.js that contain the security patches and their release date.
• This provides a direct, actionable instruction for users to apply the patches.
• This is a factual statement attributed to Vercel regarding the security of their hosted applications.
• This specifies the range of Next.js versions that are vulnerable to the Windows path traversal flaw.
• This explains the technical dependency chain leading to the AVIF vulnerability.
• This describes the AVIF vulnerability, including its cause, impact, and severity.
• This specifies the range of libheif versions vulnerable to the heap buffer overflow.

Opinions (5)

• This is a direct quote from Vercel's advisory, conveying their recommendation and assessment of the situation.
• This is a statement from researchers claiming successful exploitation, representing their opinion on the vulnerability's impact.
• This quote explains Vercel's decision-making process for advancing the patch release, reflecting their perspective on the urgency.
• This is an opinion statement about industry trends in vulnerability research.
• While stating a CVSS score, the claim of active exploitation within hours is an assertion of impact and a subjective assessment of the threat level.

Claims (5)

• This statement explicitly flags a claim as unverified, indicating a lack of independent confirmation.
• This indicates a lack of official comment from Vercel on a specific point, leaving a gap in the narrative that could be perceived as a deliberate omission or a sign of unresponsiveness.
• This highlights a lack of detail regarding the exploit method, which could be a point of concern or speculation.
• While presented as a confirmation, the fact that a critical patch is not yet published implies a potential ongoing risk or delay in full mitigation, which can be a point of concern.
• While factual about past disclosures, framing it as a 'run' can imply a pattern of systemic failure rather than isolated incidents, potentially creating a sense of alarm.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• Vercel — Web Framework Provider
• Researchers — Security Researchers
• Josh Story — Vercel
• Karim Rahal — Vercel
• Sebastian Silbermann — Vercel
• Andrew Imm — Vercel