As cited
Copy frozen at (site build).
vulnerabilities
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patched two critical vulnerabilities in Next.js that enable unauthenticated remote code execution: one through specially crafted AVIF image files and another via path traversal on Windows filesystems. Both flaws allow attackers to execute code without authentication.
Why it matters: Development teams using Next.js must apply patches immediately to prevent unauthenticated attackers from achieving remote code execution on production servers, particularly those running Windows infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patched two critical vulnerabilities in Next.js that enable unauthenticated remote code execution: one through specially crafted AVIF image files and another via path traversal on Windows filesystems. Both flaws allow attackers to execute code without authentication.
Why it matters: Development teams using Next.js must apply patches immediately to prevent unauthenticated attackers from achieving remote code execution on production servers, particularly those running Windows infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel released patches for two critical vulnerabilities in Next.js that enable unauthenticated remote code execution (RCE). One flaw involves specially crafted AVIF image files, and the other is a Windows path traversal vulnerability tracked as CVE-2026-75604 with a CVSS score of 9.0.
Why it matters: Organizations running Next.js on Windows or processing AVIF uploads need to patch immediately to prevent unauthenticated RCE attacks that require no user interaction.
- Source published
- First seen by Cybersecurity Tracker