Next.js and Kaltura face critical remote code execution vulnerabilities

Critical security vulnerabilities have been identified in Next.js and Kaltura that could allow unauthenticated remote code execution and unauthorized file access.

In Next.js, two flaws affect applications using the Image Optimization API to process AVIF images. One vulnerability, tracked as CVE-2026-75604, involves path traversal on Windows-hosted applications, potentially allowing attackers to access files outside intended directories. A second issue stems from the libheif library used by the Sharp image-processing package. Vercel has released fixes in Next.js versions 15.5.24 and 16.3.3, and immediate upgrades are recommended for Windows users as no workaround currently exists.

Separately, the CERT Coordination Center disclosed two unpatched vulnerabilities in Kaltura’s mwEmbed HTML5 video player library (CVE-2026-19913 and CVE-2026-19912). These flaws stem from unsafe deserialization, enabling remote attackers to read arbitrary files or execute code without authentication. Because the affected endpoint is exposed on Kaltura’s multi-tenant CDN infrastructure, the vulnerabilities impact both individual customer installations and all tenants served by shared hosts. As no patch is currently available, administrators are advised to restrict external access to the endpoint and implement strict allow-lists for the ServiceUrl parameter.