Loading story…
Vercel issued out-of-cycle updates for two critical unauthenticated remote-code-execution flaws in Next.js: an AVIF/HEIC image-processing heap overflow and Windows-only path traversal, tracked as CVE-2026-75604. The image flaw is rooted in libheif, reached through Next.js's sharp and libvips image-optimization chain; malicious files with duplicate alpha channels of differing bit depths can trigger a controlled heap overflow. The issue, reported with a CVSS v4 score of 9.5, was confirmed against multiple production applications, and patched Next.js releases disable AVIF optimization while an upstream dependency fix propagates.
CVE-2026-75604 affects the incremental cache on Windows because route paths do not properly escape backslashes. Attackers can use percent-encoded backslashes to leave the cache directory, read files available to the server process, and write attacker-controlled cache content to selected paths; under susceptible Server Action patterns, this can be chained to RCE. Organizations running affected Windows deployments using the Pages Router or App Router without Cache Components should upgrade to Next.js 15.5.24 or 16.3.3; no configuration-only mitigation is available. Linux and macOS are not affected by the cache-path flaw.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 25, 2026, Vercel issued an out-of-cycle Next.js security release fixing a critical AVIF image-processing heap overflow and the Windows incremental-cache path traversal flaw later identified as CVE-2026-75604. The fixes were released in Next.js 15.5.24 and 16.3.3; the AVIF mitigation disabled AVIF optimization, while the traversal fix escaped backslashes and enforced cache-path containment.
Tenable reported that exploits are available for CVE-2026-75604, the Windows incremental-cache path traversal vulnerability in Vercel Next.js. The flaw is remotely exploitable without authentication or user interaction and can affect confidentiality, integrity, and availability.
Researchers reported confirming remote code execution against multiple production applications using crafted AVIF/HEIF input processed through Next.js image optimization. The underlying libheif flaw can cause a controlled heap buffer overflow through duplicate alpha channels with differing bit depths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
fortbridge.co.uk
Open sourcetenable.com
Open sourcebashoverflow.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Next.js released **v16.3.3** and **v15.5.24** to remediate two critical unauthenticated remote-code-execution vulnerabilities. One flaw can be triggered when the Image Optimization API processes an attacker-controlled AVIF image through the `sharp` dependency and its underlying `libheif` library; Next.js disabled AVIF optimization while awaiting propagation of an upstream `libheif` fix. The second vulnerability, **CVE-2026-75604**, affects Windows-hosted applications using both the Pages Router and App Router without Cache Components; Linux and macOS deployments are not affected, and no workaround is available. The Canadian Centre for Cyber Security advised organizations running Next.js 15.5 earlier than 15.5.24 or 16.3 earlier than 16.3.3 to review the security release and apply the updates.
Sep 2, 2026Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026