If you run a Next.js application on Windows, update it today. Vercel has patched two critical flaws in the React framework that each let an unauthenticated attacker run code on the server, and for the Windows one the advisory states plainly that there is no known workaround. Both fixes shipped on 25 August 2026 in Next.js 15.5.24 and 16.3.3.
The first is CVE-2026-75604, scored 9.0 on CVSS 3.1. It hits applications that use the Pages Router, or the App Router without Cache Components, when the server sits on a Windows filesystem. The weakness is classed as path traversal, meaning the application can be steered into resolving a file path outside the directory it was supposed to stay inside. No login and no user interaction are needed, although the score records high attack complexity, so this is not a trivial one-shot request. The affected range is wide: every branch from 13.4 up to 15.5.24, and from 16.0 up to 16.3.3.
One AVIF image is enough
The second flaw has no CVE number yet, only the advisory identifier GHSA-2xp9-vwfh-vxw4, and it scores 9.5 on CVSS 4.0. It sits in the image optimization API. Next.js hands images to the sharp library, which uses libheif underneath to decode AVIF files, and a malicious AVIF sent to a vulnerable optimization endpoint can end with code running on the server. The bug belongs to libheif, tracked upstream as GHSA-g89c-p67h-r497, and it reaches all the way back to Next.js 10.0.0. Vercel disabled AVIF optimization as an interim measure while the dependency fix propagates, and its advisory is explicit that this is not a replacement for updating.
Image decoders keep turning into remote code execution because they parse attacker-supplied binary data in libraries written long before anyone pointed a web server at them. It is the same shape as the flaw that let a booby-trapped image run code on a WordPress site earlier this month.
Move to 15.5.24 or 16.3.3, and check sharp
Upgrade to 15.5.24 on the 15 branch or 16.3.3 on the 16 branch. Then confirm the dependency actually moved: the AVIF issue lives in libheif, pulled in indirectly through sharp, so a lockfile that pins an old sharp build can leave a patched Next.js still exposed. Windows-hosted deployments should be treated as the priority, since that is the case with no mitigation short of the update. Applications that never enable image optimization are not exposed to the AVIF path, but the Windows path traversal does not depend on it.
Vercel published both advisories on its own repository, as GHSA-p293-qw3h-jr36 for the Windows flaw and GHSA-2xp9-vwfh-vxw4 for the AVIF one, crediting two reporters who are not named publicly. Peru's Centro Nacional de Seguridad Digital picked both up in its integrated digital security bulletin 158-2026, which lists them among six flaws it flagged for Peruvian organisations. CVE-2026-75604 had not yet been published in the National Vulnerability Database at the time of writing, so scanners keyed to NVD may not report it for a few days.
That gap is worth planning around. A framework this widely deployed gets attacked on the vendor's disclosure clock, not on the vulnerability database's.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.