Web development platform **Vercel** has issued critical security updates for its **Next.js** framework, tackling two distinct vulnerabilities that enable unauthenticated remote code execution (RCE). These patches arrive as part of **Vercel**'s accelerated August security release, underscoring the urgency of the fixes. ### Windows Path Traversal (CVE-2026-75604) The first vulnerability, tracked as **CVE-2026-75604** (CVSS score: 9.0), is a path traversal flaw impacting **Next.js** applications that utilize both the Pages Router and App Router without Cache Components, specifically when hosted on a Windows filesystem. Linux and macOS deployments are unaffected. **Vercel**'s advisory warns, "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows." Patches are available in **Next.js** versions 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), released on August 25, 2026. Affected users can upgrade using `npm install [email protected]` for the 15.5 line or `npm install [email protected]` for the 16.3 line. Applications hosted directly on **Vercel** are automatically protected and do not require manual upgrades. This vulnerability impacts **Next.js** versions 13.4 through 15.5.23 and versions 16.0 through 16.3.2. Researchers **evolutionstorm** and **B0RI** were credited for the responsible disclosure. ### Critical AVIF Image Optimization Flaw The second critical vulnerability (GHSA-2xp9-vwfh-vxw4, CVSS v4: 9.5) stems from a heap buffer overflow in the **libheif** C library, which the **Next.js** image optimization package **sharp** relies on for processing AVIF files. This flaw can lead to remote code execution when **Next.js** processes an attacker-controlled AVIF image. The underlying **libheif** vulnerability, disclosed as GHSA-g89c-p67h-r497, involves a heap buffer overflow in the library's image scaling code. All **libheif** versions up to v1.23.1 are affected. For **Next.js**, this impacts versions 10.0.0 through 15.5.23 and all 16.x releases up to 16.3.2. The exploit involves a specially crafted AVIF file containing nested identity-derivation and auxiliary item references. This causes **libheif** to create a decoded image with two Alpha plane entries at different bit depths. The scaler, allocating a buffer for the first 8-bit Alpha entry, then writes 16-bit sample values from the second entry into the same buffer, resulting in an overwrite of approximately 16,384 bytes beyond the allocated memory. Researchers **rootxharsh** (Finder) and **KarimPwnz** (Coordinator) were credited for this discovery and released a Python proof-of-concept demonstrating the heap corruption. They claimed RCE on multiple applications, though this has not been independently corroborated. It's important to note that **Next.js** only enables AVIF optimization when `image/avif` is explicitly added to the `formats` configuration in `next.config.js`. Deployments without this specific configuration are not exposed to this particular flaw. The patched **Next.js** releases temporarily disable AVIF optimization until an upstream fix from **libheif** is available. As of August 27, 2026, **libheif** v1.23.2 had not yet been published. ### Accelerated Release and Ongoing Security Program **Vercel** advanced its scheduled August patches by a day after identifying the critical upstream dependency vulnerability. This release marks the second under **Vercel**'s formal monthly security program, which was announced in July 2026. "The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery," stated Andrew Imm and Josh Story in the July program announcement. The inaugural July release addressed nine vulnerabilities in **Next.js** 16.2.11 and 15.5.21, covering denial-of-service, server-side request forgery, and middleware bypass issues. **Next.js** has faced a series of critical security disclosures in recent years, including a critical middleware bypass flaw in March 2025 and the **React2Shell** deserialization flaw in React Server Components in December 2025, which carried a CVSS score of 10.0 and saw active exploitation shortly after disclosure. As of August 27, 2026, no active exploitation of either August vulnerability had been reported.