Critical Next.js Flaws Put Windows Servers and AVIF Image Processing at Risk of RCE

27 August 2026  |  dark6  |  Vulnerability

Two critical Next.js vulnerabilities may enable unauthenticated remote code execution through Windows path handling and AVIF image processing. Vercel fixed both issues in Next.js 15.5.24 and 16.3.3, with...

>> read more