BREAKING: Next.js unauthenticated RCE in image optimization and Windows servers (CVE-2026-75604)

Vercel shipped two critical Next.js bugs on 2026-08-25 in the same 15.5.24 / 16.3.3 cut. They are not the same bug. One is an attacker-controlled AVIF that reaches sharp libheif through Image Optimization. The other is a Windows-only path traversal that needs both routers and Cache Components off. The HOL Guard CVE feed does not have CVE-2026-75604 yet (Blog API GET /cves/CVE-2026-75604 is 404), and the AVIF issue still has no CVE. This is the operator write-up from the Next.js and Vercel advisories.

Who is not in scope

Skip the pager if any of these hold:

• The app is hosted on Vercel. Vercel disabled AVIF on managed Image Optimization after identification, and the Vercel Next.js runtime is Linux, so neither path is customer-action for platform-hosted apps.
• The Node process that serves Next.js is on Linux or macOS. CVE-2026-75604 is Windows filesystem only.
• Image Optimization is off, or AVIF never reaches the optimizer (not in images.formats, and you do not otherwise send AVIF through the optimizer). That takes you off the AVIF / libheif path.
• The Windows host is Pages-only or App-only, or Cache Components are on. CVE-2026-75604 needs both pages/ and app/ without Cache Components.
• You already run [email protected] or [email protected].

The AVIF bug reaches farther back than the Windows bug. Image Optimization AVIF RCE covers next >= 10.0.0 and < 15.5.24, and 16.x before 16.3.3. CVE-2026-75604 starts at 13.4. A 12.x or 13.3 self-hosted box can still be on the AVIF path even though it is not on the Windows router path.

What broke

Image Optimization AVIF (GHSA-2xp9-vwfh-vxw4, no CVE). Next.js image optimization uses sharp, which uses libheif. Upstream libheif GHSA-g89c-p67h-r497 is a heap overflow in scale_nearest_neighbor() when a crafted AVIF/HEIF file presents duplicate Alpha planes from nested iden/auxl items. Affected libheif is <= v1.23.1; patched is v1.23.2. When Image Optimization processes an attacker-controlled AVIF, that overflow is unauthenticated RCE in the Next.js process. Credit: Hacktron team.

The Next.js patched releases do not ship a new libheif. They disable AVIF optimization and serve AVIF as-is until an upstream fix propagates. Vercel did the same on managed Image Optimization. Patching libheif to 1.23.2 on the host does not replace the Next.js upgrade, and the Next.js upgrade does not replace a later libheif fix if you still want AVIF optimization back.

Windows unauthenticated RCE (CVE-2026-75604 / GHSA-p293-qw3h-jr36). Applications that use both the Pages Router and the App Router without Cache Components can hit unauthenticated RCE when the Next.js server uses a Windows filesystem. Linux and macOS are not affected. The GHSA classifies this as CWE-22 path traversal and scores CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). There is no known workaround; upgrade immediately if the serving host is Windows. Vercel runtime is Linux, so platform-hosted apps are not on this path. Credit: evolutionstorm, B0RI. The CVE.org record is still Reserved and has no details yet.

What this is not

This is not a Vercel platform breach. It is not one bug. CVE-2026-75604 is not the AVIF / libheif bug. The Next.js patch does not fix libheif; it turns AVIF optimization off. Installing libheif 1.23.2 does not replace [email protected] or [email protected]. We are not claiming CISA KEV listing or in-the-wild exploitation; that status is unknown.

How to check

Confirm the package the running process actually loaded:

npx next --version
# or
npm ls next

Expect a line below 15.5.24 on the 15.x (or earlier) train, or below 16.3.3 on the 16.x train, unless you already patched. Then check the host OS of the Node process that serves the app, not the laptop you deploy from. CVE-2026-75604 is about the Windows filesystem on that server.

node -p process.platform
# win32 = Windows. linux and darwin are out of scope for CVE-2026-75604.

Look at repo layout and Cache Components:

ls -d pages app 2>/dev/null
# both present is the 75604 layout. Pages-only or App-only is not.
# Cache Components on takes you off 75604 even on Windows.

Check whether AVIF goes through the optimizer:

# next.config.js / next.config.mjs / next.config.ts
# images.formats includes image/avif, or you otherwise send AVIF into Image Optimization.
# If the optimizer is disabled, or AVIF is not in formats and never processed, GHSA-2xp9 is not on that path.

How to fix

npm install [email protected]   # 15.x or earlier
npm install [email protected]    # 16.x

Same commands close both issues. After upgrade, AVIF is served as-is (no resize, no optimization) until upstream libheif is in the sharp stack. There is no workaround for the Windows bug; if process.platform is win32 and both routers are in play without Cache Components, upgrade before you do anything else.

HOL Guard does not have a source record for CVE-2026-75604 yet (the Guard CVE API 404s today). Use the Next.js August 2026 security release and the Vercel changelog as the primary records until Guard ingests the CVE.

References

• Next.js August 2026 security release
• Vercel changelog: Next.js August 2026 security release
• GHSA-p293-qw3h-jr36 (Windows RCE / CVE-2026-75604)
• GHSA-2xp9-vwfh-vxw4 (Image Optimization AVIF RCE)
• Upstream libheif GHSA-g89c-p67h-r497
• CVE-2026-75604 (Reserved)