DevThe Hacker Newsabout 3 hours ago
Next.js Patches Critical AVIF and Windows RCE Flaws
1 min read
Vercel patched two critical Next.js vulnerabilities enabling unauthenticated remote code execution. The Windows path traversal (CVE-2026-75604, CVSS 9.0) and AVIF heap overflow (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) are fixed in Next.js 15.5.24 and 16.3.3. Vercel-hosted apps need no upgrade.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
Summary by ByteBrief
