CVE-2026-75604: August 2026 Next.js Critical RCE and AVIF Image Optimization Flaw
Overview
On August 25, 2026, the Next.js team released versions 15.5.24 and 16.3.3 to address two Critical-severity unauthenticated remote code execution vulnerabilities. One issue affects Windows-hosted Next.js applications and is tracked as CVE-2026-75604. The second affects the Image Optimization API when AVIF images are processed and is tracked as GHSA-2xp9-vwfh-vxw4; no CVE had been assigned to that advisory as of August 28, 2026.
CVE-2026-75604 - Next.js Windows-Hosted Servers
| Vulnerability Name | Unauthenticated Remote Code Execution on Windows-hosted servers |
|---|---|
| CVE ID | CVE-2026-75604 |
| GHSA | GHSA-p293-qw3h-jr36 |
| Severity | Critical |
| CVSS Score | 9.0 (CVSS 3.1) |
| CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory |
| Affected Versions | Next.js >= 13.4 and < 15.5.24; Next.js >= 16.0 and < 16.3.3 |
| Affected Configuration | Windows-hosted applications using both Pages Router and App Router without Cache Components |
| Patched Versions | 15.5.24 and 16.3.3 |
| Discovered By | evolutionstorm and B0RI |
| Published Date | August 25, 2026 |
| Description | A path traversal weakness can result in remote code execution when an affected Next.js application is hosted on a Windows filesystem and the required routing configuration is present. |
GHSA-2xp9-vwfh-vxw4 - Next.js AVIF Image Optimization
| Vulnerability Name | Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
|---|---|
| Identifier | GHSA-2xp9-vwfh-vxw4 |
| CVE ID | No known CVE assigned as of August 28, 2026 |
| Severity | Critical |
| CVSS Score | 9.5 (CVSS 4.0) |
| Attack Requirements | Present (AT:P) - exploitation depends on the required AVIF-processing conditions being met |
| Underlying Component | libheif, reached through sharp and the Next.js Image Optimization API |
| Affected Configuration | AVIF optimization must be enabled for the application, such as by including image/avif in the Next.js image formats configuration, and attacker-controlled AVIF content must reach the optimization path. |
| Affected Versions | As listed by Next.js: >=10.0.0 <15.5.24 and <16.3.3 |
| Patched Versions | 15.5.24 and 16.3.3 |
| Underlying libheif Fix | libheif identifies version 1.23.2 as the patched release. Next.js 15.5.24 and 16.3.3 still disable AVIF optimization while the corrected dependency propagates through the downstream package chain. |
| Published Date | August 25, 2026 |
| Description | A crafted AVIF image can trigger a heap buffer overflow in the underlying libheif image-decoding path. Next.js reaches the affected functionality through sharp during image optimization. A network-reachable, unauthenticated image-processing path can therefore become exploitable when the required AVIF-processing conditions are present. |
Exploit Maturity Assessment
CVE-2026-75604 - Next.js Windows-Hosted Servers
The Windows-hosted vulnerability is confirmed as a Critical unauthenticated RCE, but the vendor advisory does not state that the issue is being exploited in the wild. It requires a specific application configuration: the application must run on a Windows filesystem, use both the Pages Router and App Router, and not use Cache Components.
| Factor | Assessment |
|---|---|
| Exploit Status | Technical vulnerability confirmed; no authoritative in-the-wild exploitation identified |
| Exploit Availability | Independent public PoC material is available, but no official PoC is provided by Next.js/Vercel. Third-party exploit repositories are not used as evidentiary sources in this analysis. |
| Source of Exploit | Not disclosed |
| Exploit Reliability | Not formally documented |
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The AVIF issue has a higher level of technical exploit maturity because the upstream libheif maintainers published a proof of concept for the underlying heap-buffer-overflow condition. In Next.js, practical exposure depends on AVIF optimization being enabled and attacker-controlled AVIF content reaching the Image Optimization API. The libheif advisory also states that researchers achieved RCE in multiple applications. This demonstrates that the upstream memory-corruption primitive can be weaponized beyond a crash, but it should not be interpreted as proof that RCE was specifically demonstrated through Next.js.
| Factor | Assessment |
|---|---|
| Exploit Status | Functional technical exploitation demonstrated upstream |
| Exploit Availability | Public PoC in the upstream libheif advisory |
| Source of Exploit | Official libheif security advisory |
| Exploit Reliability | Upstream libheif maintainers report RCE achieved in multiple applications; no formal success-rate assessment published |
Proof of Concept
CVE-2026-75604 - Next.js Windows-Hosted Servers
No official proof-of-concept code is provided in the Next.js advisory. Independent public PoC material is available, including code targeting the documented Windows Pages Router plus App Router configuration, but third-party exploit repositories are excluded from the evidentiary source set used for this blog. The vendor advisory defines the affected versions, platform, routing configuration, weakness class, and impact, but does not disclose a full exploitation sequence.
| Publicly Available | Independent public PoC material exists, but no official PoC is provided by Next.js/Vercel. Third-party exploit repositories are excluded from this blog's authoritative evidence set. |
|---|---|
| Description | The vendor confirms that a path traversal condition in the affected Windows-hosted configuration can lead to unauthenticated remote code execution. |
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
An official upstream PoC is available in the libheif security advisory. It demonstrates the heap-buffer-overflow condition caused by crafted HEIC/HEIF/AVIF content. The full PoC is intentionally not reproduced here.
| Publicly Available | Yes - official upstream libheif advisory |
|---|---|
| Description | The PoC demonstrates an attacker-controlled out-of-bounds write caused by duplicate Alpha planes with differing bit depths during image scaling. |
Reproducibility
CVE-2026-75604 - Next.js Windows-Hosted Servers
The issue is only partially reproducible from the authoritative advisory because Next.js documents the affected platform and framework configuration but does not provide the exact request or filesystem interaction needed to trigger the path traversal. A valid test environment would require a vulnerable Next.js release running on Windows with both Pages Router and App Router enabled and Cache Components disabled.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The underlying libheif memory corruption is reproducible from the official upstream advisory. The advisory explains the malformed image structure, the duplicate Alpha-plane condition, the resulting size mismatch, and the heap write that occurs during scaling. This provides sufficient information to reproduce the memory-corruption condition in an authorized test environment, although the full exploit path to stable RCE should be treated separately from the crash-level reproduction.
Time-to-Exploit Analysis
CVE-2026-75604 - Next.js Windows-Hosted Servers
| Metric | Assessment |
|---|---|
| Time from Disclosure to Patch | Same day - August 25, 2026 |
| Time from Disclosure to Authoritatively Verified PoC | Not established. Independent public PoC material exists, but it is excluded from this analysis under the authoritative-source-only methodology. |
| Time from Disclosure to Active Exploitation | Not applicable; no authoritative active-exploitation confirmation identified |
| Risk Interpretation | Immediate patch priority. The flaw is unauthenticated RCE, remotely reachable in affected deployments, and the vendor states that no workaround is available. |
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
| Metric | Assessment |
|---|---|
| Time from Disclosure to Patch | Same day - August 25, 2026 |
| Time from Disclosure to Authoritative PoC | Same day - upstream libheif advisory includes a PoC |
| Time from Disclosure to Active Exploitation | Not established; no authoritative in-the-wild exploitation confirmation identified |
| Risk Interpretation | Immediate. A network-reachable, unauthenticated image-processing path can be exploitable when the required AVIF-processing conditions are present. The upstream libheif advisory includes a public PoC and reports RCE achieved in multiple applications. |
Active Exploitation & Threat Actors
CVE-2026-75604 - Next.js Windows-Hosted Servers
Exploitation Observed in the Wild: No CISA KEV listing or vendor-confirmed in-the-wild exploitation was identified during verification on August 28, 2026.
Associated Threat Actors: No named threat actor, APT group, ransomware operator, or initial access broker has been attributed in the vendor material reviewed.
Campaign Details: No campaign has been authoritatively documented.
Attack Techniques Observed: No in-the-wild technique chain has been published by the vendor.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
Exploitation Observed in the Wild: No CISA KEV listing or vendor-confirmed in-the-wild exploitation was identified during verification on August 28, 2026.
Associated Threat Actors: Not disclosed.
Campaign Details: No campaign has been authoritatively documented.
Attack Techniques Observed: The upstream advisory demonstrates technical exploitation of the heap-buffer-overflow condition, but this is not evidence of an operational campaign.
Vulnerability Timeline
CVE-2026-75604 - Next.js Windows-Hosted Servers
| Event | Date |
|---|---|
| Vulnerability Discovered | Not publicly disclosed |
| Vendor Notified | Not publicly disclosed |
| Public Disclosure | August 25, 2026 |
| Patch Released | August 25, 2026 - Next.js 15.5.24 and 16.3.3 |
| PoC Released | Independent public PoC material exists; no vendor-provided or otherwise authoritatively verified PoC publication date is established in this analysis. |
| Exploitation in Wild Began | Not authoritatively confirmed |
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
| Event | Date |
|---|---|
| Vulnerability Discovered | Not publicly disclosed |
| Vendor Notified | Not publicly disclosed |
| Public Disclosure | August 25, 2026 |
| Patch Released | August 25, 2026 - Next.js 15.5.24 and 16.3.3 |
| Upstream libheif Fix | libheif identifies version 1.23.2 as the patched release; Next.js continues to disable AVIF optimization in its patched releases while the dependency fix propagates downstream. |
| Official Upstream PoC | Available in the August 25, 2026 libheif advisory |
| Exploitation in Wild Began | Not authoritatively confirmed |
Root Cause Analysis
CVE-2026-75604 - Next.js Windows-Hosted Servers
CVE-2026-75604 is a path traversal vulnerability classified as CWE-22. In the affected Next.js configuration, attacker-controlled path information can escape the intended filesystem boundary on Windows-hosted servers. The issue is specific to applications using both Pages Router and App Router without Cache Components. The path traversal can be converted into remote code execution, resulting in high confidentiality, integrity, and availability impact.
The official advisory does not expose the complete internal traversal sequence, request shape, or filesystem primitive. This limits safe public reconstruction but does not reduce the importance of the flaw: Next.js assigns a Critical severity score of 9.0 and states that affected Windows deployments have no known workaround.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The AVIF issue originates in libheif, which Next.js reaches through sharp during image optimization. The upstream flaw is a heap-buffer overflow in scale_nearest_neighbor(). A crafted HEIC/HEIF/AVIF file can create duplicate Alpha planes with different bit depths. The destination allocation is created based on the first Alpha plane, while a later higher-bit-depth Alpha plane is written using a wider sample size.
This causes the scaling routine to write beyond the end of the allocated heap buffer. The upstream advisory states that both the overflow extent and written values can be influenced by attacker-controlled image content, which significantly increases exploitability. Next.js mitigated the issue by disabling AVIF optimization in patched versions until the fixed upstream dependency is available through the normal dependency chain.
Impact
CVE-2026-75604 - Next.js Windows-Hosted Servers
Successful exploitation can result in unauthenticated remote code execution on the affected Windows-hosted Next.js server. Because the flaw is remotely reachable and requires neither authentication nor user interaction, a vulnerable internet-facing application can expose the underlying server to compromise when the affected routing configuration is present.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The AVIF flaw can turn image processing into a server compromise path. An attacker who can cause a crafted AVIF file to be optimized can reach the vulnerable libheif decoding routine through sharp. The upstream heap-buffer-overflow primitive can corrupt process memory and has been shown by the libheif maintainers to support RCE in multiple applications. The authoritative sources reviewed do not state that RCE was specifically demonstrated through Next.js.
Post-Exploitation Details
CVE-2026-75604 - Next.js Windows-Hosted Servers
No authoritative source currently describes a standard post-exploitation sequence, persistence mechanism, payload, or campaign associated with CVE-2026-75604. The confirmed technical outcome is remote code execution; any subsequent credential theft, lateral movement, persistence, or data exfiltration would depend on attacker behavior after initial compromise.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The upstream libheif advisory confirms that the memory-corruption flaw can be converted into RCE, but it does not document an in-the-wild post-exploitation campaign. No authoritative persistence mechanism, malware payload, command-and-control infrastructure, or lateral-movement activity has been linked to this Next.js exposure.
MITRE ATT&CK Mapping
| Identifier | Tactic | Technique | ID |
|---|---|---|---|
| CVE-2026-75604 | Initial Access | Exploit Public-Facing Application - applicable as a defensive analytical mapping for a remotely exploitable web framework flaw | T1190 |
| GHSA-2xp9-vwfh-vxw4 | Initial Access | Exploit Public-Facing Application - applicable as a defensive analytical mapping when an exposed image optimization endpoint processes attacker-controlled content | T1190 |
These are analytical defensive mappings based on the exposed application attack surface. They are not vendor-provided mappings, are not confirmed campaign mappings, and should not be interpreted as evidence that either issue has been observed in a documented threat campaign.
Vulnerability Chaining Opportunities
CVE-2026-75604 - Next.js Windows-Hosted Servers
The Windows issue does not require a second vulnerability to reach RCE when the affected framework and hosting conditions are present. In a broader intrusion, successful code execution could theoretically be followed by operating-system or credential-based techniques, but no authoritative multi-CVE chain has been documented.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
The important chain is a dependency chain rather than a multi-CVE chain: Next.js Image Optimization invokes sharp, which in turn reaches the vulnerable libheif image-decoding implementation. No additional vulnerability is required to trigger the underlying memory corruption when attacker-controlled AVIF data reaches the affected code path.
Detection and Monitoring
CVE-2026-75604 - Next.js Windows-Hosted Servers
Detection should start with exposure identification. Inventory Windows-hosted Next.js applications, determine their framework version, and identify deployments that use both Pages Router and App Router without Cache Components. On vulnerable systems, monitor reverse-proxy and application logs for unusual path traversal patterns, unexpected filesystem access following HTTP requests, and child-process creation that does not match normal application behavior.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
Monitor use of the Next.js Image Optimization API and identify whether AVIF optimization is enabled, including whether image/avif appears in the image formats configuration, and whether remote or user-controlled AVIF content can be processed. Unexpected Node.js or image-worker crashes after AVIF requests should be investigated. After patching, confirm that the updated Next.js release is running and that AVIF optimization is disabled as expected until the corrected upstream dependency chain is present.
Risk Assessment
| Vulnerability | Impact | Exploit Maturity | Overall Risk |
|---|---|---|---|
| CVE-2026-75604 | Critical - unauthenticated RCE on affected Windows-hosted Next.js deployments | Vendor-confirmed RCE condition; independent public PoC exists, but no official vendor PoC is published | Critical |
| GHSA-2xp9-vwfh-vxw4 | Critical - heap corruption leading to RCE through AVIF image optimization | Official upstream PoC; upstream libheif maintainers report RCE achieved in multiple applications | Critical |
Both issues warrant urgent remediation despite the absence of confirmed in-the-wild exploitation. CVE-2026-75604 combines unauthenticated RCE with a lack of vendor workaround on affected Windows deployments, while the AVIF issue has stronger exploit-maturity evidence because the upstream maintainers publish a reproducible memory-corruption PoC and report successful RCE.
Patch and Mitigation
CVE-2026-75604 - Next.js Windows-Hosted Servers
Upgrade affected applications to Next.js 15.5.24 or 16.3.3 or later. The Next.js advisory states that there is no known workaround for affected Windows-hosted applications. Windows-hosted deployments should therefore be treated as immediate patch priorities, particularly when they are internet accessible.
GHSA-2xp9-vwfh-vxw4 - AVIF Image Optimization
Upgrade to Next.js 15.5.24 or 16.3.3 or later. The patched releases disable AVIF optimization until the upstream fix propagates through the dependency chain. The upstream libheif advisory identifies version 1.23.2 as the patched release for the underlying heap-buffer-overflow condition. Next.js 15.5.24 and 16.3.3 still disable AVIF optimization while the corrected dependency propagates through the downstream package chain.
Remediation Recommendations
Immediate actions should prioritize upgrading all affected Next.js applications to 15.5.24 or 16.3.3 or later. Windows-hosted deployments should be identified first because CVE-2026-75604 has no vendor workaround. Applications that have AVIF optimization enabled should also be reviewed immediately, especially when image/avif is included in the image formats configuration and images originate from remote or user-controlled sources.
Near-term actions should verify the running application version after deployment, not only the package version in source control. Review hosting operating systems, router configuration, Image Optimization settings, remote image sources, and any custom infrastructure that could continue serving an older build after the package has been updated.
Long-term improvements should include accurate software-component inventories, dependency monitoring, rapid framework patching, isolation of public-facing application services, and monitoring for unexpected child processes or filesystem activity from Node.js application servers. Dependency-driven vulnerabilities such as the AVIF flaw also demonstrate the importance of tracking transitive native libraries, not only top-level npm packages.
Instantly Fix Risks with Saner Patch Management
Saner Patch Management is a continuous, automated, and integrated patch management solution that helps organizations rapidly remediate security risks across Windows, Linux, macOS, and a broad range of third-party applications.
The platform supports automated deployment workflows, patch testing, compliance reporting, and rollback capabilities to help reduce operational risk while keeping critical software updates moving quickly across enterprise environments.
Experience the fastest and most accurate patching software here.
