"There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows," Vercel said in its advisory.
CVE-2026-75604: a Windows path-traversal that can yield unauthenticated RCE
Vercel disclosed a critical path traversal vulnerability tracked as CVE-2026-75604 with a CVSS score of 9.0 that can lead to unauthenticated remote code execution in Next.js. The flaw affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem. Linux and macOS deployments are not affected.
Vercel's advisory explicitly warns that there is no workaround for affected Windows-hosted applications and urges immediate upgrade for servers hosted on Windows. The company credited the researchers evolutionstorm and B0RI with responsible disclosure of the Windows vulnerability in its changelog.
AVIF image optimization flaw in libheif: a heap overflow with RCE potential
Next.js uses the sharp image processing package, which in turn relies on the libheif C library to parse AVIF images. A critical heap buffer overflow in libheif's image scaling code (disclosed as GHSA-g89c-p67h-r497) can lead to remote code execution when Next.js processes a crafted AVIF file. The Next.js advisory references the vulnerability as GHSA-2xp9-vwfh-vxw4 with a CVSS v4 score of 9.5.
The underlying bug is triggered by a crafted AVIF file containing nested identity-derivation and auxiliary item references that cause libheif to build a decoded image with two Alpha plane entries at different bit depths. The scaler allocates a destination buffer sized for the first, 8-bit Alpha entry but then writes 16-bit sample values from the second entry into the same buffer, overwriting roughly 16,384 bytes past the allocation boundary.
The libheif advisory credited rootxharsh as Finder and KarimPwnz as Coordinator and included a full Python proof-of-concept that reproduces the heap corruption under an address sanitizer build. The researchers wrote, "We were able to get RCE using this on multiple applications," although that claim has not been independently corroborated. All libheif versions through v1.23.1 are affected.
Not all Next.js deployments are exposed: AVIF optimization is enabled only when a site explicitly adds image/avif to the formats configuration in next.config.js. The patched Next.js releases turn off AVIF optimization entirely until an upstream fix propagates from libheif; as confirmed on August 27, 2026 via the libheif GitHub releases page, v1.23.2 had not been published.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPatch details, timelines, and who is protected
Vercel published fixes on August 25, 2026, in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS). Affected Next.js versions are 13.4 through 15.5.23 and 16.0 through 16.3.2. Users can upgrade by running npm install next@15.5.24 for the 15.5 line or npm install next@16.3.3 for the 16.3 line.
Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade, Vercel said in a changelog entry published August 25. Vercel had planned the August patches for August 26 as part of its monthly security cadence, but moved the release forward one day after discovering an additional critical-severity vulnerability in an upstream dependency. "Earlier today, we moved the release forward after identifying an additional critical severity vulnerability in one of our upstream dependencies," Josh Story, Karim Rahal, and Sebastian Silbermann wrote in Vercel's security blog post.
Vercel's August release is the second under its formal monthly security program announced in July 2026. The company noted rising research volume, saying, "The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery," in the July 13 program announcement co-signed by Andrew Imm and Josh Story. The July 21 release addressed nine vulnerabilities in Next.js 16.2.11 and 15.5.21; however, Vercel noted that users already on those July patches still need the August upgrade.
What this means for technologists, procurement leaders, and adversaries
- Technologists and security teams: If your Next.js server runs on Windows, Vercel's advisory states there is no workaround — apply Next.js 15.5.24 or 16.3.3 immediately. For AVIF exposure, check next.config.js for image/avif in formats; deployments that did not enable AVIF optimization are not exposed to the libheif defect.
- Affected enterprises and procurement leaders: Confirm hosting platforms — Vercel-hosted applications are protected and require no action from customers, while self-hosted Windows deployments must be patched. Review vendor patch cadences and whether third‑party libraries (libheif/sharp) are in use in your image-processing stack.
- Adversaries and researchers: A public Python proof-of-concept reproduces the heap corruption under ASAN and researchers report RCE in multiple applications; as of August 27, 2026, there had been no public corroboration and no reported exploitation of the August vulnerabilities. Observers will likely watch for a libheif upstream release and any weaponized exploits.
No exploitation of either August vulnerability had been reported as of August 27, 2026. The Hacker News reached out to Vercel for comment and had not received a response by the time of publication.
The immediate, concrete actions are clear in Vercel's own words: Windows-hosted Next.js operators must upgrade without delay, AVIF-enabled sites should be reviewed, and organizations should track the libheif upstream fix. Whether libheif publishes v1.23.2 promptly and whether public proof-of-concept code will be used in the wild are the next facts to watch.
