Affected Systems

Next.js versions 13.4–15.5.23 and 16.0–16.3.2. CVE-2026-75604 (Windows path traversal, CVSS 9.0) affects Windows-hosted servers using Pages Router or App Router without Cache Components. AVIF flaw (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) affects versions 10.0.0–15.5.23 and all 16.x through 16.3.2, only when image/avif is explicitly enabled in next.config.js. Linux and macOS are not affected by the Windows flaw. Vercel-hosted applications are protected without upgrade.

Exploitation Status

No active exploitation reported as of August 27, 2026. Full Python proof-of-concept exists for the AVIF heap buffer overflow (libheif GHSA-g89c-p67h-r497). Researchers claim successful RCE on multiple applications. Windows path traversal attack mechanism not publicly disclosed.

Business Impact

Unauthenticated remote code execution is possible on vulnerable Next.js deployments. Windows-hosted applications using affected routers face immediate risk with no workaround available. AVIF exposure is limited to sites that explicitly enable image/avif format optimization. Self-hosted Next.js instances require immediate patching; Vercel-hosted apps are already protected. Given Next.js's widespread use in production web applications and the availability of a working PoC for the AVIF flaw, exploitation attempts are likely once attackers weaponize the research.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Next.js immediately to version 15.5.24 (Maintenance LTS) or 16.3.3 (Active LTS) using npm install next@15.5.24 or npm install next@16.3.3
  • Prioritize Windows-hosted Next.js servers using Pages Router or App Router without Cache Components for immediate patching—no workaround exists
  • Audit next.config.js for image/avif in formats configuration; if present, verify upgrade completion as AVIF optimization is disabled in patched versions
  • Monitor web application logs for unusual AVIF image upload activity or unexpected image processing errors that may indicate exploitation attempts
  • Review Next.js deployment inventory to identify self-hosted instances on Windows; Vercel-hosted applications do not require action