Next.js Rushes Fixes for Two Critical Bugs That Let Attackers Run Code Without Logging In
Vercel patched flaws in the popular web framework that could be triggered by a booby-trapped image or a rigged URL on Windows servers.
Key points
- Vercel patched two critical vulnerabilities in Next.js, a widely used framework for building websites, that let attackers run their own code on a server without needing to log in.
- One flaw is triggered by a specially crafted AVIF image, a modern image format, processed by the site's image tools.
- The second flaw, CVE-2026-75604, is a path traversal bug that only affects Next.js sites running on Windows servers.
- Both bugs were reported by researchers at Hacktron and disclosed alongside fixed versions on Vercel's advisory pages.
- Site operators should update Next.js immediately; ordinary web visitors do not need to take action.
Vercel has pushed emergency fixes for two critical bugs in Next.js, the JavaScript framework that powers a large share of modern websites, including many e-commerce and media sites you have probably used this week.
Both flaws let an unauthenticated attacker, meaning someone with no account and no password, run their own code on the server hosting the site. That is about as bad as web vulnerabilities get.
The issues were reported by researchers at Hacktron and confirmed by Vercel, the company that maintains Next.js. The Hacker News flagged the advisories earlier this week.
What are the two bugs?
One is in how Next.js handles AVIF images. The other is a path traversal flaw on Windows servers. Both give an attacker the ability to run commands on the server.
The first bug lives in the framework's built-in image optimisation feature, which resizes and re-encodes images on the fly. A malicious AVIF file, a newer image format designed to be smaller than JPEG, can trip the image processor into executing attacker-supplied code when the server tries to open it.
The second bug, tracked as CVE-2026-75604, is a path traversal flaw. Path traversal means an attacker crafts a URL with sequences like ../ that trick the server into reading or writing files outside the folder it was supposed to stay inside. On Windows filesystems, that mistake can be chained into full remote code execution.
Only sites running Next.js on Windows are exposed to the second flaw. The AVIF bug affects Next.js installs regardless of the underlying operating system, as long as image optimisation is enabled.
Who is at risk?
Any organisation running an unpatched version of Next.js on a public-facing site. That is a very large group, from small startups to Fortune 500 marketing pages.
Attackers who successfully exploit either bug get a foothold on the web server. From there they can steal environment variables (which often contain database passwords and API keys), plant a backdoor, or pivot deeper into the company's network.
There is no indication so far that either flaw has been exploited in the wild, but proof-of-concept details tend to appear within days of disclosure for bugs this serious.
What should site operators do?
Update Next.js to the patched release listed in Vercel's security advisory, and do it today. If you cannot patch immediately, disable the built-in image optimisation feature as a temporary workaround for the AVIF bug, and move Windows-hosted deployments behind a reverse proxy that normalises URLs.
A quick checklist for teams:
| Action | Why |
|---|---|
| Upgrade Next.js to the fixed version | Closes both bugs at the source |
| Audit which sites run on Windows | Only Windows deployments are exposed to CVE-2026-75604 |
| Disable image optimisation if you cannot patch | Removes the AVIF attack path |
| Rotate secrets stored on the server | Assumes worst case if the server was already exposed |
End users visiting sites built with Next.js do not need to do anything. This is a server-side problem, and the fix is on the operator's side. If you run a site yourself and are not sure which framework version it uses, ask whoever built it, or check your package.json file.
No regulator filings have been made public so far. If exploitation is confirmed and personal data is exposed at scale, notification duties under the GDPR, the UK Data Protection Act, and US state breach laws would kick in for the affected site owners, not for Vercel itself.
