Vercel has announced critical security patches for two vulnerabilities within the Next.js web framework, both of which pose significant risks by allowing unauthenticated remote code execution (RCE). The first vulnerability is associated with specially crafted AVIF image files, while the second stems from a path traversal flaw affecting servers utilizing a Windows filesystem. The latter has been designated as CVE-2026-75604, highlighting the urgency of addressing these issues to safeguard applications built on this framework.
For businesses leveraging Next.js, these vulnerabilities underscore the importance of maintaining updated frameworks and applying security patches promptly. Failure to address such critical flaws could lead to unauthorized access and control over web applications, potentially resulting in data breaches and significant operational disruptions. The implications for cybersecurity are profound, as these findings serve as a reminder of the continuous threat landscape and the necessity for robust security practices in software development and deployment.
---
*Originally reported by [The Hacker News](https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html)*