Next.js Moved Its Security Release Forward. Two Unauthenticated RCEs Were Waiting.
Next.js moved its August security release forward by a day and shipped fixes for two critical vulnerabilities that can lead to unauthenticated remote code execution. The two issues share the same urgent outcome, but they reach it through very different parts of the deployment stack.
One vulnerability sits in the image-optimization path used for AVIF files. The other is a Windows-specific path traversal in affected Pages Router and App Router deployments. Next.js 16.3.3 and 15.5.24 contain the fixes. Administrators should not treat this as a generic framework alert: exposure depends on the hosting platform, application configuration and whether AVIF optimization is reachable.
Two critical routes to the same consequence
| Issue | Exposure condition | Fixed releases |
|---|---|---|
| GHSA-2xp9-vwfh-vxw4 | Next.js Image Optimization processes an AVIF file through the vulnerable dependency path | 15.5.24 and 16.3.3 |
| CVE-2026-75604 / GHSA-p293-qw3h-jr36 | Affected Pages Router or App Router application without Cache Components runs on a Windows filesystem | 15.5.24 and 16.3.3 |
The distinction matters operationally. A Linux-hosted application is outside the Windows-specific condition, but it may still expose the AVIF processing route. A deployment that never optimizes AVIF images avoids that second trigger, but can remain vulnerable on Windows. Inventory has to include runtime and feature use, not only the package version.
The AVIF flaw crosses a dependency boundary
The AVIF advisory carries a critical CVSS v4 score of 9.5. It describes a vulnerability in libheif, used by sharp, which Next.js in turn uses for image optimization. When a vulnerable application optimizes a malicious AVIF file, the condition can lead to remote code execution without authentication or user interaction.
This is a framework vulnerability from the defender’s perspective even though the unsafe primitive originates deeper in the media stack. Applications expose the image endpoint, the framework selects the processing library and the dependency performs the dangerous parse. That chain is why dependency-only scanning can be insufficient: defenders also need to know whether the vulnerable code path is externally reachable.
Next.js said AVIF optimization is disabled until the upstream fix has propagated. That reduces immediate reachability in fixed releases, but it is not a substitute for upgrading an affected deployment. The advisory lists versions from 10.0.0 through the affected supported lines, with 15.5.24 and 16.3.3 as patched releases.
The Windows flaw has no workaround
The Windows-hosted issue has a critical CVSS 3.1 score of 9.0 and is classified as path traversal. It affects specified Next.js versions from 13.4 onward when an application uses the Pages Router or App Router without Cache Components and the server runs on a Windows filesystem.
The advisory says there is no known workaround for affected Windows-hosted applications. Upgrade is the required remediation. The attack is network-accessible, needs no prior privileges and requires no user interaction, although the CVSS vector records high attack complexity. That complexity should not be mistaken for a compensating control, particularly once technical analysis or exploit tooling becomes public.
Why the release moved forward
Next.js originally planned the release for 26 August, then advanced it to 25 August. The project published 16.3.3 for the Active LTS line and 15.5.24 for the Maintenance LTS line. Moving a coordinated release forward is itself a useful urgency signal, but it does not prove malicious exploitation.
At initial publication on 25 August, BlackTree found no vendor confirmation of exploitation in the wild and no credible public proof of concept for either Next.js issue. The evidence has since changed for the Windows vulnerability. There is still no vendor or government confirmation of malicious exploitation of either issue.
Update: a public exploit module now demonstrates the Windows path
Update, 27 August 2026: a contributor has submitted a draft Metasploit module for CVE-2026-75604 to Rapid7’s public repository. The pull request remains a work in progress and has not been merged into Metasploit. It nevertheless contains exploit code, an automated vulnerability check and test output showing a Meterpreter session opened on a Windows 10 target. All 18 automated repository checks shown on the pull request currently pass.
That is credible public exploit availability, not evidence of a malicious campaign. The module applies only to the Windows-hosted Next.js vulnerability. It does not demonstrate exploitation of the separate AVIF image-optimization issue.
Cloudflare also published an emergency WAF release on 26 August. It refined the description of an existing blocking rule for the Windows flaw and added a new blocking rule for the crafted-AVIF route. The Windows detection itself was unchanged. These controls can reduce exposure for traffic that passes through the applicable managed ruleset, but they do not replace upgrading and redeploying the application.
What defenders should do
- Upgrade supported Next.js deployments to 16.3.3 or 15.5.24 and rebuild production artifacts from a clean dependency installation.
- Identify Windows-hosted applications using the Pages Router or App Router without Cache Components and place them at the front of the patch queue.
- Map every deployment that exposes the Image Optimization API and determine whether AVIF processing is enabled or reachable through attacker-controlled input.
- Review reverse-proxy and application logs for unusual image-optimization requests, repeated AVIF failures and unexpected child-process or filesystem activity.
- Confirm the running artifact, container or serverless bundle actually contains the fixed package version. Updating a lockfile without redeploying does not remove production exposure.
- Check whether a platform provider changes the vulnerable path. Netlify, for example, says its Linux runtime excludes the Windows issue and its Image CDN rewrite bypasses the affected Next.js AVIF code path.
The broader lesson is that a framework version is only one dimension of exposure. Operating system semantics and native media dependencies can create independent trust boundaries inside the same application. Patch quickly, then validate the route that production traffic actually takes.
Sources
- Next.js, “August 2026 Security Release”, published 25 August 2026. The page provides no publication time.
- Vercel Next.js advisory GHSA-2xp9-vwfh-vxw4, published 25 August 2026. GitHub provides no publication time.
- Vercel Next.js advisory GHSA-p293-qw3h-jr36, published 25 August 2026. GitHub provides no publication time.
- Netlify, “Next.js Security Vulnerabilities”, published 25 August 2026. The page provides no publication time.
- Rapid7 Metasploit Framework pull request 21834, submitted as a draft on 27 August 2026. GitHub displays 00:56 for the draft event but does not identify the timezone in the page view.
- Cloudflare, “WAF Release – 2026-08-26 – Emergency”, published 26 August 2026. The page provides no publication time.
