Vercel patches critical Next.js vulnerabilities

Next.js Vercel remote code execution security vulnerability path traversal

Vercel has released emergency security patches for Next.js to address two critical vulnerabilities that could allow unauthenticated remote code execution.

The first flaw, tracked as CVE-2026-75604, is a Windows-specific path traversal vulnerability with a CVSS score of 9.0. It affects applications using the Pages Router or the App Router without Cache Components when hosted on a Windows filesystem. Vercel has stated, “There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.”

The second vulnerability is an AVIF image optimization flaw, rated with a CVSS v4 score of 9.5. This heap buffer overflow is triggered by malicious AVIF images processed via the sharp package.

Developers using self-hosted Next.js deployments are urged to update to versions 15.5.24 or 16.3.3 to mitigate these risks.

Entities

Next.js · Vercel

Sources

Kritische Ebyte-Schwachstellen: Authentifizierung und Admin-Zugriff betroffen [cybersecurity-news.de]

21 days ago

Dell PowerStore SDNAS: SMB-CIFS-Lücke ermöglicht RCE und DoS (CVE-2026-67271) [www.it-boltwise.de]

22 days ago

Next. js Security Update: Two Critical Vulnerabilities Require Immediate Patching [www.businesstechweekly.com]

22 days ago