Next.js has received a security update to fix two critical vulnerabilities that can lead to remote code execution without authentication. The patches were made available in versions 15.5.24 and 16.3.3.
The first flaw, CVE-2026-75604, received a CVSS score of 9.0 and affects applications hosted on Windows servers that use Pages Router or App Router without Cache Components. The issue is related to path traversal. An attacker can manipulate paths processed by the application and, under specific conditions, achieve code execution on the server without requiring credentials or user interaction. Vulnerable versions include those from 13.4 up to but not including 15.5.24, as well as the 16.0 line up to but not including 16.3.3. There is no workaround for affected Windows servers.
The second vulnerability targets the Image Optimization API when AVIF files are processed. A specially crafted malicious AVIF file can exploit the image processing pipeline and result in code execution. This flaw affects versions from 10.0.0 up to releases prior to 15.5.24, plus versions 16 prior to 16.3.3.
Administrators should update dependencies, rebuild containers, and confirm that production environments run Next.js 15.5.24 or 16.3.3 or later, with priority given to Windows servers and applications that process user-submitted images.
