Next.js Rushes Fixes for Two Critical Bugs That Let Attackers Run Code Without Logging In

Key points

• Vercel patched two critical vulnerabilities in Next.js, a widely used framework for building websites, that let attackers run their own code on a server without needing to log in.
• One flaw is triggered by a specially crafted AVIF image, a modern image format, processed by the site's image tools.
• The second flaw, CVE-2026-75604, is a path traversal bug that only affects Next.js sites running on Windows servers.
• Both bugs were reported by researchers at Hacktron and disclosed alongside fixed versions on Vercel's advisory pages.
• Site operators should update Next.js immediately; ordinary web visitors don't need to take action.

Vercel has pushed emergency fixes for two critical bugs in Next.js, the JavaScript framework that powers a large share of modern websites. Both flaws let an unauthenticated attacker, meaning someone with no account and no password, run their own code on the server hosting the site. That's about as bad as web vulnerabilities get.

The issues were confirmed by Vercel, which credits Hacktron researchers with the discovery. We reported on a separate Vercel problem on 6 August, when AI agents at the platform could be tricked into running tools without authorisation; that one stayed inside the AI layer. These new bugs sit in the web framework itself, which is a wider exposure.

What are the two bugs?

One lives in the framework's built-in image processing, which handles resizing on the fly. A malicious AVIF file, a newer format designed to be smaller than JPEG, can trip that processor into executing attacker-supplied code when the server tries to open it. This bug affects any Next.js installation with image optimisation enabled, regardless of operating system.

The second bug, tracked as CVE-2026-75604, is a path traversal flaw. Path traversal means an attacker crafts a URL containing sequences like ../ that trick the server into reading or writing files outside the directory it's supposed to stay inside. On Windows filesystems that mistake can be chained into full remote code execution. Sites not running Next.js on Windows aren't exposed to this one.

Who is at risk?

Any organisation running an unpatched version of Next.js on a public-facing server. That's a broad population.

Attackers who successfully exploit either bug get a foothold on the web server. From there they can steal environment variables (which often contain database passwords and API keys), plant a backdoor, or pivot deeper into the company's network. There's no indication either flaw has been exploited in the wild yet, but proof-of-concept details tend to surface within days of disclosure for bugs this serious.

What should site operators do?

Update Next.js to the patched release listed in Vercel's security advisory, and do it today. If you can't patch immediately, disabling the built-in image processing removes the AVIF attack path, and moving Windows-hosted deployments behind a reverse proxy that normalises URLs reduces exposure to CVE-2026-75604.

End users visiting Next.js-built sites don't need to do anything. If you run a site and aren't sure which framework version it uses, check your package.json file or ask whoever built it.

Should you worry about data exposure?

No regulator filings have been made public so far. If exploitation is confirmed and personal data is exposed at scale, notification duties under GDPR, the UK Data Protection Act, and US state breach laws would fall on affected site owners, not on Vercel itself. The thing to watch is whether any large platform confirms a breach in the coming days: that's when regulatory timelines start running, and that's when this moves from a patching story to a privacy story.