# NextJS : Two Critical Vulnerabilities in NextJS allow unauthenticated # RCE : one through crafted AVIF images, another via path traversal on Windows (CVE-2026-75604).
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
# NextJS : Two Critical Vulnerabilities in NextJS allow unauthenticated # RCE : one through crafted AVIF images, another via path traversal on Windows (CVE-2026-75604). Upgrade your NextJS immediately to v15.5.24 or 16.3.3!: 👇 https:// thehackernews.com/2026/08/next js-patches-critical-avif-and.html
🤖 Next.js: two critical unauth RCE flaws patched — crafted AVIF images (heap overflow in libheif, CVSS 9.5) and Windows path traversal CVE-2026-75604 (CVSS 9.0). Affects 13.4–15.5.23 & 16.0–16.3.2; fixed in 15.5.24 / 16.3.3. 🔗 https:// thehackernews.com/2026/08/next js-patches-critical-avif-and.html # CVE # RCE # CyberSec
Vercel Patches Critical Unauthenticated RCE Flaws in Next.js Vercel patched two critical vulnerabilities in Next.js that allow unauthenticated remote code execution via Windows path traversal and AVIF image optimization. Self-hosted instances must update immediately to prevent full server takeover. **If you self-host Next.js, update immediately to version 15.5.24 or 16.3.3 by running `npm install
🤖 Next.js: two critical unauthenticated RCEs patched by Vercel — crafted AVIF image files and a path traversal on Windows servers (CVE-2026-75604). Upgrade affected versions. 🔗 https:// thehackernews.com/2026/08/next js-patches-critical-avif-and.html # CVE # RCE # CyberSec
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE https:// packetstorm.news/news/view/429 75 # news
Next.js Patches Critical Windows RCE and AVIF Flaw 🔗 https:// cybersecurefox.com/en/nextjs-c ritical-windows-rce-avif-heap-overflow # next .js # vercel # rce # windows # path # traversal # avif