Vercel has released emergency patches for two critical unauthenticated remote code execution (RCE) vulnerabilities in the Next.js web framework. Both flaws allow an attacker to execute arbitrary code on a server without any credentials — making them severe risks for any site still running an unpatched version.
The first vulnerability, tracked as CVE-2026-75604 (CVSS 9.0), is a Windows-specific path traversal flaw affecting Next.js applications that use the Pages Router or App Router without Cache Components on a Windows server. Linux and macOS deployments are not affected. “There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows,” Vercel said in its advisory. The second vulnerability (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) is a heap buffer overflow in the libheif library that Next.js uses to process AVIF image files. An attacker can trigger the overflow by sending a specially crafted AVIF image to any site with image optimization enabled, which is the default in Next.js. The underlying libheif flaw affects all versions through v1.23.1. Both flaws were fixed in Next.js 15.5.24 and 16.3.3, published August 25, 2026. Applications deployed on Vercel’s own platform are automatically protected.
How to check if you’re affected
Affected versions are Next.js 13.4 through 15.5.23 and 16.0 through 16.3.2. To check your version, run npm list next in your project directory. If you are on one of these versions, upgrade immediately:
- Next.js 15.x:
npm install next@15.5.24 - Next.js 16.x:
npm install next@16.3.3
Applications hosted on Vercel.com are automatically patched and require no action.