Affected Systems
Next.js versions 13.4–15.5.23 and 16.0–16.3.2. CVE-2026-75604 (Windows path traversal, CVSS 9.0) affects Windows-hosted servers using Pages Router or App Router without Cache Components. AVIF flaw (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) affects versions 10.0.0–15.5.23 and all 16.x through 16.3.2, only when image/avif is explicitly enabled in next.config.js. Linux and macOS unaffected by path traversal. Vercel-hosted applications protected without upgrade.
Exploitation Status
No active exploitation reported as of August 27, 2026. Full Python proof-of-concept published for AVIF heap buffer overflow. Researchers claim RCE achieved on multiple applications. Attack mechanism for Windows path traversal not disclosed.
Business Impact
Unauthenticated remote code execution on vulnerable Next.js deployments. Windows-hosted applications using affected versions face immediate risk with no workaround available. AVIF vulnerability requires attacker-controlled image upload or processing. Self-hosted deployments at higher risk; Vercel-hosted sites already protected. Organizations using Next.js for customer-facing applications or image processing pipelines should prioritize patching.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade Next.js immediately: run 'npm install next@15.5.24' for 15.x line or 'npm install next@16.3.3' for 16.x line
- Prioritize Windows-hosted Next.js servers (CVE-2026-75604) — no workaround exists, upgrade is mandatory
- Review next.config.js for image/avif in formats configuration; if present, AVIF flaw applies and patching is critical
- Monitor application logs for unusual AVIF image upload activity or Windows path traversal attempts (e.g., ../ sequences in file paths)
- If immediate patching is not feasible for AVIF exposure, temporarily remove image/avif from next.config.js formats array until upgrade completes