CRITICAL vulnerabilities in Next.js have been identified: CVE-2026-75604 (CVSS 9.0) allows unauthenticated remote code execution on Windows machines, and an AVIF image optimization bug (CVSS 9.5) poses a similar threat. Affected versions include those from 13.4 to 15.5.24 for the Windows RCE and from 10.0.0 to below 16.3.3 for the AVIF bug. While no exploitation has been confirmed, it is crucial for users to upgrade to Next.js versions 15.5.24 or 16.3.3 to mitigate risks. Until patched, disabling AVIF optimization is advised.
Next.js vulnerabilities let attackers run code on Windows machines
CyberSIXT Evidence Panel
Article by CyberSIXT