45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated Remote Code Execution
Do Son 
TL;DR
Vercel patched two critical Next.js flaws that allow unauthenticated remote code execution. One is CVE-2026-75604, scoring CVSS 9.0. The other, an AVIF image bug, scores 9.5. Next.js sees over 45 million weekly npm downloads, so patch fast.
Why This Next.js Vulnerability Matters
Next.js powers full-stack apps at some of the world’s largest companies. With 45 million weekly downloads, the reach is huge. A single Next.js vulnerability here can expose countless production servers.
Both flaws earned critical scores. Because neither needs a login, attackers face a low bar. As a result, unpatched servers risk full compromise.
How the Attacks Work
The first flaw is a path traversal bug, tracked as CVE-2026-75604. Vercel says it can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
It affects apps using the Pages and App router without Cache Component.
The second flaw sits in the image optimization API. It comes from the libheif library that sharp uses. Vercel notes the bug triggers when AVIF files are optimized.
Consequently, a crafted AVIF file can run code on the server.
Is It Being Exploited?
No exploitation in the wild has been confirmed. Neither advisory reports active attacks. Likewise, no public proof-of-concept exists yet.
Affected Versions
The Windows RCE bug hits versions 13.4 up to 15.5.24, and 16.0 up to 16.3.3. The AVIF bug reaches back further, from 10.0.0 up to 15.5.24, and below 16.3.3.
Patch and Mitigation Steps
Upgrade to Next.js 15.5.24 or 16.3.3 now. Review the advisories for the Windows RCE flaw and the AVIF image optimization flaw. No workaround exists for the Windows bug. Until you patch, disable AVIF optimization to blunt the second flaw.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
