Developers running Next.js applications face two critical vulnerabilities that can lead to remote code execution under specific hosting and image-processing conditions. Both weaknesses are remotely reachable without authentication or user interaction, and both are fixed in Next.js 15.5.24 and 16.3.3.

The issues affect separate parts of the framework’s image pipeline. One centers on path traversal on Windows-hosted applications; the other arises when the Image Optimization API processes a malicious AVIF file through an underlying image library. Organizations should update even if they believe only one of the two conditions applies.

Windows path traversal can escape intended directories

CVE-2026-75604 affects applications using either the Pages Router or the App Router without Cache Components when deployed on a Windows filesystem. The vulnerability is classified under path traversal, a weakness in which special path elements are not sufficiently constrained before an application constructs or accesses a file location.

A crafted remote request may cause the server to reach outside the directory Next.js intended to use. The advisory assesses the attack as high complexity, but it needs neither an account nor action by a victim. Successful exploitation could expose confidential information, modify server-side content or interrupt service; the overall impact reaches confidentiality, integrity and availability.

The vulnerable ranges cover releases from Next.js 13.4 up to, but excluding, 15.5.24, as well as Next.js 16 releases before 16.3.3. Because no workaround is available for affected Windows installations, an upgrade is the primary defensive action.

Malicious AVIF files threaten the optimization service

The second critical issue affects deployments that use the Image Optimization API to optimize AVIF images. Next.js relies on the Sharp package for resizing and conversion, and Sharp in turn uses the libheif component to handle this image format. A deliberately malformed AVIF file can reach the vulnerable native-code path when the service processes it.

The reported outcome is remote code execution. An attacker may be able to submit a hostile image to an exposed optimization endpoint and gain control in the server process without authenticating. The flaw affects Next.js versions from 10.0.0 through releases before 15.5.24, as well as version 16 before 16.3.3.

Next.js temporarily disabled AVIF optimization while the corrected dependency moved through the release process. That safeguard is not a reason to postpone upgrades: production environments may have different configuration, dependency resolution or build artifacts, and only a verified patched runtime provides a reliable answer.

Updating source code is only the first step

Modern web deployments frequently package dependencies into immutable containers or prebuilt server bundles. Changing a version declaration without rebuilding and redeploying those artifacts can leave the vulnerable code running. Teams should update the framework, refresh the lockfile, produce clean builds and confirm the version inside every active workload.

• Upgrade supported branches to Next.js 15.5.24 or 16.3.3, or a later vendor-approved release.
• Rebuild containers and server bundles rather than relying on a source-only change.
• Check Windows-hosted production and staging systems for affected router configurations.
• Review whether public users can supply image URLs or files to optimization endpoints.
• Search logs for unusual traversal strings, repeated image requests and anomalous AVIF processing failures.

Reduce exposure around image processing

Image optimization is often treated as a performance feature, but it parses complex, attacker-influenced formats inside a server process. Defenders should limit permitted remote image sources, validate uploads before processing, enforce file and resource limits, and isolate the service so a compromise cannot freely reach credentials or internal systems.

Web application firewalls may catch obvious traversal attempts or abnormal requests, but they cannot be relied on to understand every malformed binary image. Endpoint monitoring and process-level telemetry can help detect child processes, unusual file access or outbound connections originating from the Next.js runtime.

The shared fix versions make remediation straightforward, yet verification is essential. Security and engineering teams should use software inventories or dependency scanning to find all Next.js deployments, including internal tools and dormant preview environments. Once patched, the same inventory can provide evidence that vulnerable builds are no longer serving traffic.