# Two RCE Flaws in Next.js Put Millions of Sites at Risk — One Hides in an Image File
Vercel just patched a pair of critical vulnerabilities in Next.js that, taken together, cover a surprisingly wide blast radius: one hits any deployment that processes AVIF images, the other targets servers running on Windows. Both allow unauthenticated remote code execution. No login required. No user interaction. Just a crafted request.
The dual disclosure is the kind of thing that gets lost in the noise of a busy patch week, but it shouldn't. Next.js powers a substantial slice of the modern web — e-commerce storefronts, SaaS dashboards, media platforms — and the combination of unauthenticated access and two distinct attack vectors means defenders need to treat this as an active threat, not a scheduled maintenance item.
## The AVIF Angle Is the More Interesting Story
AVIF has been the image format the web industry has been quietly pushing for three years. It delivers better compression than WebP and JPEG, and major browsers adopted it enthusiastically. The problem is that AVIF decoding is computationally non-trivial — the format is built on AV1 video codec internals, which means the underlying libraries tend to be dense, low-level C code that processes attacker-controlled binary data.
That's a classic recipe for memory corruption bugs.
When Next.js processes image requests through its built-in image optimization pipeline — the next/image component, which virtually every modern Next.js site uses — it invokes native image libraries under the hood. If an attacker can supply a malformed AVIF file and trigger that processing path without authentication, they're feeding crafted binary data into native code. The rest writes itself.
This isn't the first time image format handling has opened up full RCE on a widely-deployed platform. ImageMagick's "ImageTragick" vulnerabilities in 2016 burned an enormous number of applications for exactly this reason — image processing pipelines are opaque, trusted by default, and reachable from the outside world by design. libwebp's critical heap buffer overflow in 2023 (CVE-2023-4863) hit Chrome, Firefox, and every Electron application on earth. AVIF joins a pattern that should by now feel familiar.
The concerning part here is that Next.js's image optimization is opt-in per component but effectively ubiquitous in real deployments. Sites that process user-uploaded images — profile photos, product listings, attachments — are particularly exposed, because they're running attacker-supplied files through that pipeline with no natural quarantine.
## Windows Path Traversal: An Old Wound That Won't Close
The second flaw, CVE-2026-75604, exploits a path traversal issue specific to servers deployed on Windows filesystems. Path traversal on Windows has a longer and more embarrassing history than most developers realize, because Windows path handling has quirks that Unix-oriented code frequently fails to account for: case insensitivity, drive letter prefixes, UNC paths, alternate data streams, the behavior of \ versus /, and the treatment of trailing dots and spaces.
Web framework developers writing for Linux tend to test on Linux. Windows gets treated as a secondary deployment target, which means the normalization logic that strips ../ sequences may work fine on POSIX paths and fail silently on Windows-style ones.
The result here is unauthenticated RCE — which means path traversal capable of writing or executing files, not merely reading them. That's a more severe outcome than classic "I can read /etc/passwd" traversal. It suggests the traversal reaches far enough into the server's filesystem to affect code execution paths.
Who runs Next.js on Windows in production? More organizations than you'd expect. Enterprise environments with Windows-heavy infrastructure often deploy Node.js applications on Windows Server rather than introducing Linux into a homogeneous Windows estate. Internal tools, intranet applications, and organizations in regulated industries that have standardized on Windows are all potential targets.
## What "Unauthenticated" Actually Means Here
It's worth spelling out the severity explicitly. Unauthenticated RCE means the vulnerability is reachable before the application has a chance to apply any of its own access controls. Firewall rules aside, any deployment with the affected endpoints publicly accessible is vulnerable without a logged-in session. There's no need for a phishing campaign, no credential stuffing, no social engineering — just a request.
For the AVIF flaw, the attack path likely runs through Next.js's image optimization endpoint, which is a standard part of the framework's request routing. Disabling image optimization across a production site is not a reasonable mitigation for most teams; it would break layout and performance for real users.
Patch. Don't mitigate.
## Upgrading Is the Only Real Answer
Vercel's patches address both vulnerabilities, and the upgrade path for Next.js is typically straightforward for applications that haven't heavily pinned their dependencies. The immediate steps:
---
## HackWire Analysis
The timing of this disclosure is worth examining. We're in a period of accelerating Next.js adoption across enterprise environments, partly driven by Vercel's aggressive enterprise sales and partly by the React ecosystem's gradual consolidation around Next.js as the default "serious" framework. That growth means the vulnerable surface area is not static — it's been expanding.
What's missing from most of the coverage on this is the AVIF-specific risk model. The security community has spent years building awareness around SVG injection, XML entity attacks, and PDF processing vulnerabilities, but AVIF's attack surface is less well-understood, partly because the format is newer and partly because the underlying codec libraries don't have the same public scrutiny history as, say, libjpeg or libpng. That gap in collective knowledge means defenders are less likely to have AVIF-specific detection or sandboxing in place.
The Windows path traversal flaw fits a pattern that goes back decades: cross-platform frameworks built by Unix-native teams shipping security bugs in their Windows code paths. This is not a criticism unique to Vercel — it's a structural problem in the industry. Windows filesystem semantics are genuinely different enough that testing parity is hard to maintain, and the economic incentive to invest heavily in Windows-specific security testing is often lower than it should be given actual deployment numbers.
The deeper lesson is that framework-level vulnerabilities are systematically underweighted in threat models. Organizations spend substantial resources securing their application code and very little auditing their framework dependencies. A single critical flaw in Next.js, Express, or Spring has a broader blast radius than almost any application-level bug — and these flaws arrive without warning, requiring immediate action across potentially dozens of services simultaneously.
Defenders in environments with large Next.js footprints should be running dependency inventory tooling that surfaces this kind of exposure automatically, not discovering it through a blog post or patch notes read the following week.
— HackWire Editorial
---
## Related Coverage