Loading story…
Next.js released v16.3.3 and v15.5.24 to remediate two critical unauthenticated remote-code-execution vulnerabilities. One flaw can be triggered when the Image Optimization API processes an attacker-controlled AVIF image through the sharp dependency and its underlying libheif library; Next.js disabled AVIF optimization while awaiting propagation of an upstream libheif fix.
The second vulnerability, CVE-2026-75604, affects Windows-hosted applications using both the Pages Router and App Router without Cache Components; Linux and macOS deployments are not affected, and no workaround is available. The Canadian Centre for Cyber Security advised organizations running Next.js 15.5 earlier than 15.5.24 or 16.3 earlier than 16.3.3 to review the security release and apply the updates.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record detailed that improperly escaped encoded Windows path separators can traverse outside Next.js incremental-cache paths on affected Windows deployments. The traversal may expose private build data, including the server-reference-manifest encryption key, whose disclosure can enable remote code execution.
The Canadian Centre for Cyber Security issued advisory AV26-851 warning that Next.js 15.5 before 15.5.24 and 16.3 before 16.3.3 are affected by critical vulnerabilities. It urged users and administrators to review the August 2026 security release and apply available updates.
Technical details identified GHSA-g89c-p67h-r497 as a libheif heap buffer overflow underlying the malicious AVIF/HEIC processing path in Next.js Image Optimization. The flaw can create duplicate Alpha planes with different bit depths, leading to an undersized allocation and 16-bit writes; libheif 1.23.2 was identified as the patched upstream version.
Next.js released versions 16.3.3 and 15.5.24 to address two critical unauthenticated remote-code-execution vulnerabilities. One involves attacker-controlled AVIF images processed by the Image Optimization API through sharp and libheif; the releases disable AVIF optimization pending an upstream libheif fix. The other, CVE-2026-75604, affects Windows-hosted applications using both Pages Router and App Router without Cache Components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
14 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecsirt.bj
Open sourcecsirt.sk
Open sourceheise.de
Open sourcenextjs.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcevercel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel issued out-of-cycle updates for two critical unauthenticated remote-code-execution flaws in Next.js: an AVIF/HEIC image-processing heap overflow and Windows-only path traversal, tracked as `CVE-2026-75604`. The image flaw is rooted in `libheif`, reached through Next.js's `sharp` and `libvips` image-optimization chain; malicious files with duplicate alpha channels of differing bit depths can trigger a controlled heap overflow. The issue, reported with a CVSS v4 score of 9.5, was confirmed against multiple production applications, and patched Next.js releases disable AVIF optimization while an upstream dependency fix propagates. `CVE-2026-75604` affects the incremental cache on Windows because route paths do not properly escape backslashes. Attackers can use percent-encoded backslashes to leave the cache directory, read files available to the server process, and write attacker-controlled cache content to selected paths; under susceptible Server Action patterns, this can be chained to RCE. Organizations running affected Windows deployments using the Pages Router or App Router without Cache Components should upgrade to **Next.js 15.5.24 or 16.3.3**; no configuration-only mitigation is available. Linux and macOS are not affected by the cache-path flaw.
Sep 4, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026