Next.js patched an unauthenticated RCE at CVSS 9.5. The bug is not in Next.js, it is in the C library its image optimizer decodes your images with

What Next.js patched

On 25 August 2026, Next.js shipped fixes for two critical flaws, and both are the kind that a lot of teams will not realise apply to them. The headline one is an unauthenticated remote code execution, CVSS 9.5, and it does not live in anyone’s application code. It lives in the image optimizer, in a C library Next.js uses to decode images. The second, a Windows path traversal at CVSS 9.0, is in some ways worse, because there is no workaround.

No exploitation has been reported in the wild yet, but the researchers were blunt: they got remote code execution with the AVIF flaw on multiple real applications. If you run Next.js, this is a today problem, and the first thing to know is whether you are even exposed.

The AVIF flaw: your image optimizer is a C decoder

Next.js can serve smaller images by re-encoding them on the fly, and one of the formats it can target is AVIF. To decode AVIF it calls libheif, a C library, and that is where the bug is.

A convenience feature on the RCE path

The mechanism is a clean example of why decoding untrusted media is dangerous. In the advisory’s words, a crafted AVIF with nested identity-derivation and auxiliary item references makes libheif build an image with two alpha planes at different bit depths. The scaler then allocates a buffer for 8-bit alpha and writes 16-bit values into it, running about 16,384 bytes past the end of the allocation. A heap overflow of that size, in a decoder reachable without logging in, is a remote code execution primitive.

The saving grace is that it is opt-in. Next.js only routes images through the AVIF decoder if you asked it to.

The one config line that decides your exposure

This is the whole difference between exposed and safe, and it is worth checking in your own repository right now.

// next.config.js
// This single line routes every optimized image through the AVIF decoder,
// which is the code path the CVSS 9.5 overflow lives on.
const nextConfig = {
  images: { formats: ["image/avif", "image/webp"] },
};

// The fix is an upgrade. The patched releases disable AVIF entirely until
// libheif is repaired upstream (v1.23.2):
//   npm install next@15.5.24     // 15.x line
//   npm install next@16.3.3      // 16.x line

If image/avif is not in your formats, this particular flaw does not reach you. If it is, you are one crafted image away from running attacker code, and the fix is to upgrade, which removes AVIF for you until the upstream library is safe.

The Windows flaw has no workaround

The second bug, CVE-2026-75604, is a path traversal that affects Next.js apps on Windows filesystems only, using either the Pages Router or the App Router without Cache Components. Linux and macOS are not affected. The advisory is explicit that there is no workaround: if your server is on Windows, upgrading is the only mitigation.

The two flaws, and when each one reaches you

Flaw	CVSS	Affected versions	Fixed in	You are exposed when
AVIF heap overflow, GHSA-2xp9-vwfh-vxw4	9.5	10.0.0 to 15.5.23, and 16.0 to 16.3.2	15.5.24 and 16.3.3	image/avif is in your image formats config
Windows path traversal, CVE-2026-75604	9.0	13.4 to 15.5.23, and 16.0 to 16.3.2	15.5.24 and 16.3.3	the server runs on a Windows filesystem

The pattern: the convenience is the surface

This site keeps finding the same shape, and here it is in a framework almost everyone reading this uses. A feature that exists purely for convenience, on-the-fly image optimization, quietly pulls a memory-unsafe C library into the request path of an unauthenticated endpoint. Nobody wrote insecure code. Someone enabled a format. The vulnerable surface is a dependency of a dependency, decoding attacker-controlled bytes, and the framework’s own code is not where the bug is.

It is the same lesson as the prefix cache that makes inference cheap and leaks who serves you: the performance feature and the exposure are the same feature. Server-side rendering did not abolish the classic web vulnerability classes, it inherited them, and image handling has been an RCE-shaped hole in web stacks for twenty years.

What to do this week

The position

The interesting thing here is not that Next.js had a bug, it is where the bug was. The framework’s own code was not at fault. A convenience feature reached into a C library to decode a format, and decoding attacker-controlled bytes in memory-unsafe code is one of the oldest ways to get owned. The opt-in nature of AVIF is the only reason this is not a catastrophe for every Next.js site at once, and the fix being to disable the feature entirely tells you the maintainers do not yet trust the decoder either.

The practical takeaway is small and worth doing today: grep your config for image/avif, upgrade, and if you are on Windows upgrade regardless. The larger one is the durable one. Every convenience that parses untrusted input server-side is a liability you did not write and may not know you enabled, and the only defence is knowing which ones you turned on.