Critical Next.js Vulnerabilities Expose Applications to Remote Code Execution

The landscape of web development is constantly shifting, with frameworks like Next.js offering unparalleled speed and flexibility. However, even the most robust tools can harbor dangerous flaws. Recent discoveries have unveiled two critical Next.js vulnerabilities that allow unauthenticated remote code execution (RCE) on applications hosted on Windows servers, particularly when processing AVIF images through the Image Optimization API. This is a significant concern for developers and security professionals alike, as successful exploitation could grant attackers full control over compromised systems.

Understanding the Vulnerabilities: CVE-2026-75604 and CVE-2026-75605

Two distinct vulnerabilities have been identified, each posing a severe threat to Next.js applications:

• CVE-2026-75604: This flaw impacts Next.js applications utilizing either the Pages Router or the App Router, specifically when Cache Components are not in use. An attacker can exploit this weakness when the application is running on a Windows host and processes a specially crafted AVIF image via the Image Optimization API. The core issue lies in how certain internal library functions handle paths, allowing for directory traversal and arbitrary file creation, which ultimately leads to remote code execution.
• CVE-2026-75605: Similar to its counterpart, this vulnerability also targets Next.js applications on Windows servers processing AVIF images through the Image Optimization API. While the exact technical nuances differ, the outcome is the same: unauthenticated remote code execution. This particular flaw further emphasizes the critical need for careful handling of image processing, especially with potentially malicious file types.

Both vulnerabilities hinge on the interaction between Next.js’s Image Optimization API, the AVIF image format, and the underlying Windows operating system. The vulnerability arises from an improper handling of paths within internal library functions when processing these images, enabling attackers to write arbitrary files to sensitive locations on the server.

Impact of Remote Code Execution

Remote Code Execution (RCE) is one of the most severe types of vulnerabilities. If successfully exploited, an attacker gains the ability to execute arbitrary commands on the server. This can lead to a wide range of devastating consequences, including:

• Data Theft: Access to sensitive customer data, intellectual property, and internal company information.
• System Compromise: Installation of malware, backdoors, or ransomware, leading to complete control over the server.
• Website Defacement: Altering website content or redirecting users to malicious sites.
• Further Network Penetration: Using the compromised server as a pivot point to attack other systems within the organization’s network.
• Reputational Damage: Loss of customer trust and significant harm to the organization’s brand.

Given these potential outcomes, immediate action is crucial for any organization running affected Next.js applications on Windows.

Remediation Actions for Next.js Users

Addressing these critical vulnerabilities requires prompt and decisive action. Here are the essential steps to mitigate the risk:

• Update Next.js: The most critical step is to update your Next.js application to the latest patched version. Always refer to the official Next.js documentation and release notes for specific update instructions and versions that include the fixes. This typically involves updating your next package in package.json and reinstalling dependencies.
• Review Image Optimization Usage: If your application uses the Image Optimization API, especially for AVIF images, assess whether this functionality is strictly necessary. If not, consider disabling or limiting its use until updates are applied and thoroughly tested.
• Implement Input Validation: While patches are essential, robust input validation should always be a fundamental security practice. Ensure that any user-supplied data, including image uploads, is rigorously validated to prevent malicious payloads.
• Restrict File Uploads: If your application allows image uploads, restrict accepted file types to only those absolutely necessary and implement strict size limits. Consider using content-type sniffing in addition to file extensions for validation.
• Principle of Least Privilege: Ensure that the Next.js application runs with the minimum necessary permissions on the server. This can limit the impact of a successful RCE attack.
• Monitor Logs: Regularly monitor application and server logs for any suspicious activity, unexpected file creations, or unusual process executions that could indicate an attempted or successful exploit.

Detection and Mitigation Tools

Leveraging the right tools can significantly aid in identifying vulnerable systems and fortifying your defenses.

Tool Name	Purpose	Link
OWASP Dependency-Check	Identifies known vulnerabilities in project dependencies.	OWASP Dependency-Check
Snyk	Finds and fixes vulnerabilities in code, dependencies, containers, and infrastructure.	Snyk
Trivy	Comprehensive scanner for vulnerabilities in container images, file systems, Git repositories, and more.	Trivy
Veracode	Application security testing platform for static, dynamic, and software composition analysis.	Veracode

Conclusion

The discovery of critical RCE vulnerabilities in Next.js serves as a stark reminder that even widely used and trusted frameworks require continuous vigilance. These flaws, CVE-2026-75604 and CVE-2026-75605, specifically target Windows-hosted applications processing AVIF images through the Image Optimization API. Developers and security teams must prioritize updating their Next.js installations, reviewing image processing configurations, and implementing robust security best practices to protect their applications and users from potential compromise. Proactive patching and a layered security approach are the most effective defenses against such critical threats.