Vercel has released Next.js patches for two vulnerabilities with the highest severity (critical). Both issues can lead to unauthenticated remote code execution, meaning attackers do not need an account and can execute code on vulnerable servers. One problem happens through processing AVIF images; the other stems from a path traversal flaw on Windows hosts.
For organizations using Next.js, this is especially relevant if your environment runs on Windows or if AVIF optimization has been explicitly enabled. Below you’ll find what’s going on, who is affected, and how to upgrade quickly.
What Vercel patched in Next.js
The updates address two critical-severity vulnerabilities that both result in unauthenticated RCE. Vercel implemented the fixes in two supported release lines: the Maintenance LTS and the Active LTS.
The patched versions were released on August 25, 2026:
- Next.js 15.5.24 (Maintenance LTS)
- Next.js 16.3.3 (Active LTS)
Users should upgrade according to Vercel’s guidance:
- for the 15.5 line: npm install next@15.5.24
- for the 16.3 line: npm install next@16.3.3
Note: the vulnerabilities apply to Next.js 13.4 up to and including 15.5.23 and to 16.0 up to and including 16.3.2.
Windows path traversal: CVE-2026-75604 (CVSS 9.0)
The first vulnerability is a Windows path traversal issue identified as CVE-2026-75604. The severity is backed by a CVSS score of 9.0. In particular, it affects Next.js applications running on a Windows filesystem and that use a specific router setup.
Vercel states the problem impacts apps that both:
- work with both Pages Router and App Router, and
- do not use Cache Components
There is an important detail here: Linux and macOS deployments are not affected.
According to Vercel, there is no known workaround for Windows-hosted applications. So the advice is very direct: upgrade immediately if your server runs on Windows.
What makes this extra risky?
Path traversal is a category that can allow attackers to read or influence files outside the intended locations. Because the outcome here is described as unauthenticated remote code execution, you should not treat this as merely an “information leak” issue. It requires quick action because the attack can occur without authentication.
If you’re also dealing with supply chain or credential exposure in your ecosystem, it may help to look more broadly at how attacks can persist across build and deployment processes. See, for example, the context around supply chain and credentials in
