Critical Next.js RCE Vulnerabilities Demand Immediate Patching: CVE-2026-75604 Analysis
Executive Summary
Vercel released security patches on August 25, 2026, for two critical vulnerabilities in Next.js that enable unauthenticated remote code execution. CVE-2026-75604 (CVSS 9.0) affects Windows-hosted Next.js applications through a path traversal flaw, while a second vulnerability (CVSS 9.5) exploits AVIF image processing via a heap buffer overflow in the libheif library. Both vulnerabilities affect multiple Next.js versions spanning from 10.0.0 through 16.3.2, with no known workarounds for affected Windows deployments requiring immediate upgrades.
This incident highlights the growing trend of AI-assisted vulnerability discovery and emphasizes the critical importance of securing web application frameworks. As Next.js powers millions of applications worldwide, these RCE vulnerabilities demonstrate how upstream dependency flaws and platform-specific issues can create widespread attack surfaces across the modern web ecosystem.
Why This Matters Now
The surge in AI-assisted vulnerability research is accelerating the discovery of critical flaws in widely-used frameworks like Next.js, creating urgent security gaps that affect millions of web applications and require immediate patching to prevent widespread exploitation.
Attack Path Analysis
Attackers exploited Next.js web applications through two critical vulnerabilities: CVE-2026-75604 (Windows path traversal) and a heap buffer overflow in AVIF image processing. Initial compromise occurred via crafted AVIF uploads or path traversal exploitation leading to remote code execution. Post-exploitation activities likely included privilege escalation through system compromise, potential lateral movement to connected resources, establishment of command and control channels, data exfiltration from compromised applications, and business impact through service disruption or data theft.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited CVE-2026-75604 Windows path traversal vulnerability or uploaded malicious AVIF images to trigger heap buffer overflow in libheif library, achieving unauthenticated remote code execution on Next.js applications
Related CVEs
CVE-2026-75604
CVSS 9A path traversal vulnerability in Next.js applications using Pages Router and App Router without Cache Components on Windows filesystems allows unauthenticated remote code execution.
Affected Products:
Vercel Next.js – 13.4 through 15.5.23, 16.0 through 16.3.2
Exploit Status:
no public exploitCVE-2026-AVIF-001
CVSS 9.5A heap buffer overflow in libheif library used by Next.js for AVIF image processing allows remote code execution when processing specially crafted AVIF image files.
Affected Products:
Vercel Next.js – 10.0.0 through 15.5.23, 16.x through 16.3.2
strukturag libheif – all versions through v1.23.1
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Process Injection: Process Hollowing
Command and Scripting Interpreter: Python
File and Directory Discovery
Server Software Component: Web Shell
Exploitation for Defense Evasion
Exploitation for Privilege Escalation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Security Framework
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Application Security
Control ID: 500.08
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Application Security
Control ID: Applications and Workloads
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21.2(a)
ISO 27001:2022 – Management of Technical Vulnerabilities
Control ID: A.8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical Next.js RCE vulnerabilities expose web applications to unauthenticated attacks via AVIF images and Windows path traversal, requiring immediate patches.
E-Learning
Educational platforms using Next.js face remote code execution risks from malicious AVIF uploads and Windows-hosted server path traversal vulnerabilities.
Financial Services
Banking and financial web applications built with Next.js vulnerable to unauthenticated RCE attacks, potentially compromising sensitive customer data and transactions.
Health Care / Life Sciences
Healthcare web platforms using Next.js exposed to critical RCE flaws, risking HIPAA compliance violations and patient data breach through image processing exploits.
Sources
- Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCEhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.htmlVerified
- Next.js Security Advisory - Windows Path Traversal Vulnerabilityhttps://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36Verified
- Next.js Security Advisory - AVIF Image Processing Vulnerabilityhttps://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4Verified
- libheif Security Advisory - Heap Buffer Overflowhttps://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497Verified
- Vercel Changelog - Next.js August 2026 Security Releasehttps://vercel.com/changelog/nextjs-august-2026-security-releaseVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF would have significantly constrained this Next.js exploitation by limiting lateral movement paths and controlling egress communications. The segmented architecture would likely reduce the attacker's blast radius and restrict access to connected cloud resources.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial compromise would likely still occur, but CNSF workload isolation would constrain the attacker's ability to access adjacent application components and cloud resources beyond the compromised Next.js instance.
Control: Zero Trust Segmentation
Mitigation: Privilege escalation attempts would likely face constrained access paths due to identity-aware segmentation policies that limit service account permissions and restrict cross-workload privilege inheritance within the cloud environment.
Control: East-West Traffic Security
Mitigation: Lateral movement attempts would likely be significantly constrained by east-west traffic enforcement policies that restrict inter-workload communications and limit access to databases and connected cloud services based on identity verification.
Control: Multicloud Visibility & Control
Mitigation: Command and control establishment would likely face detection and potential blocking through comprehensive traffic monitoring and behavioral analysis that identifies anomalous outbound communication patterns from the compromised Next.js application workload.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts would likely be constrained by egress policy enforcement that controls and monitors outbound data transfers, potentially limiting the volume and destinations of sensitive information leaving the compromised application environment.
While some business impact would likely remain, the constrained blast radius from Zero Trust segmentation would reduce the scope of affected systems and limit the overall exposure of sensitive customer data and critical business operations.
Impact at a Glance
Affected Business Functions
- Web Application Development
- Content Management Systems
- E-commerce Platforms
- Customer-Facing Web Services
Estimated downtime: 2 days
Estimated loss: N/A
Potential exposure of application source code, configuration files, and user session data through remote code execution capabilities. Risk extends to any data accessible by the web application process including databases and API keys.
Recommended Actions
Key Takeaways & Next Steps
- • Implement inline IPS with signature-based detection to block known exploit patterns and malicious payloads targeting web application vulnerabilities before they reach application servers
- • Deploy cloud firewall with egress filtering and URL filtering to prevent command and control communications and restrict outbound traffic from compromised applications
- • Establish zero trust segmentation with least privilege policies to limit lateral movement from compromised web applications to other critical systems and data stores
- • Enable multicloud visibility and control with traffic observability to detect anomalous interactions, repeated malformed requests, and suspicious automation targeting web applications
- • Implement egress security and policy enforcement to prevent unauthorized data exfiltration and monitor outbound traffic patterns for signs of data theft from web applications
