On April 17, 2025, Vercel shipped emergency patches for Next.js after discovering two critical vulnerabilities that let unauthenticated attackers execute arbitrary code on affected servers. One exploits Windows path handling, and the other is in image processing. Both score high enough on CVSS to wake you up at 3 AM.
If you're running Next.js 13.4 through 15.5.23 or 16.0 through 16.3.2, you've got a decision to make right now.
What Happened
Two distinct flaws surfaced in Next.js:
CVE-2026-75604 (CVSS 9.0): A Windows-specific path traversal vulnerability allows attackers to bypass security checks in the Next.js server. Windows handles file paths differently than Unix systems, and Next.js's validation logic didn't account for these differences. An attacker could craft requests with Windows-style path separators to access files outside the intended directory.
AVIF Processing Vulnerability: A heap buffer overflow in libheif v1.23.1 and earlier, the library Next.js uses for AVIF image optimization. When Next.js processes a maliciously crafted AVIF image file, the overflow occurs during decoding, potentially allowing remote code execution.
Both vulnerabilities require no authentication and affect production deployments. Both were patched in the same release cycle.
Timeline
- April 17, 2025: Vercel releases security patches addressing both vulnerabilities.
- Same day: CVE-2026-75604 assigned for the Windows path traversal flaw.
- Affected versions identified: Next.js 13.4-15.5.23 and 16.0-16.3.2.
- Patch versions released: 15.5.24 and 16.3.3.
The compressed timeline suggests Vercel discovered these issues through internal security work or coordinated disclosure, not active exploitation in the wild. That's your window.
Which Controls Failed
Input Validation: The Windows path traversal vulnerability represents a failure in cross-platform input validation. PCI DSS v4.0.1 Requirement 6.2.4 mandates that applications validate input from untrusted sources. Next.js validated paths, but the validation logic broke on Windows because it didn't normalize path separators before checking.
Dependency Security: The libheif vulnerability shows what happens when you don't control your dependency tree. You're not just running Next.js code. You're running libheif, and whatever libheif depends on, and so on. OWASP ASVS v4.0.3 Section 14.2 requires that applications use only known-good dependencies with no known vulnerabilities. Every dependency you add multiplies your attack surface.
Platform-Specific Testing: Running tests on Linux doesn't tell you what breaks on Windows. ISO 27001 Annex A.8.31 requires that development and testing environments mirror production configurations. If you're deploying to Windows servers but testing on macOS or Linux, you're missing an entire class of bugs.
Patch Management: Between discovery and your deployment, there's a gap. NIST CSF v2.0 Function PR.IP-12 calls for a vulnerability management plan that includes timely patching. The question isn't whether you'll patch. It's whether you'll patch before someone finds your exposed instance.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.3.2: Develop applications based on secure coding guidelines. This includes validating all input, which means understanding how different operating systems interpret file paths. Windows uses backslashes. Unix uses forward slashes. Your validation needs to handle both, or explicitly reject one.
OWASP ASVS v4.0.3 Requirement 1.14.1: Verify that the application uses a single, vetted mechanism for validating input. The Next.js path traversal bug happened because the validation mechanism didn't account for platform differences. One validator. All platforms.
NIST 800-53 Rev 5 SI-2: Flaw remediation. Organizations must identify, report, and correct system flaws. This includes third-party components like libheif. You need a process to track dependency versions, monitor for vulnerabilities, and deploy patches within defined timeframes.
SOC 2 Type II CC7.1: The entity identifies and assesses changes that could significantly impact the system of internal control. A critical RCE vulnerability in your web framework qualifies. Your change management process should flag these patches as high-priority and fast-track them through testing.
Lessons and Action Items
Patch immediately: If you're running affected Next.js versions, upgrade to 15.5.24 or 16.3.3 today. Don't wait for the next sprint. RCE vulnerabilities don't respect your release calendar.
Audit your deployment platforms: If you're running Next.js on Windows servers, check whether your CI/CD pipeline tests on Windows. If it doesn't, you're blind to platform-specific bugs. Add Windows to your test matrix, or migrate to Linux where the framework sees more testing.
Map your dependency tree: Run npm list libheif or equivalent for your package manager. Know what's in your build. The AVIF vulnerability affects you only if you're using Next.js's built-in image optimization with AVIF support. If you've disabled that feature or you're not processing AVIF files, your exposure is different. But you need to know.
Set up vulnerability monitoring: Tools like Dependabot, Snyk, or OWASP Dependency-Check can alert you when dependencies have known CVEs. Configure them to flag anything with CVSS ≥7.0 and route those alerts to someone who can act within 24 hours.
Test your patch deployment speed: Time how long it takes to go from "patch available" to "patch deployed in production" for a critical security fix. If it's more than 48 hours, that's your gap. Document what slowed you down and fix those bottlenecks now, before the next emergency.
Review your image processing: If you're using Next.js image optimization, understand what formats you're accepting and where those images come from. User-uploaded content goes through different validation than images you control. The libheif overflow triggers during decode, so validation before decode doesn't help. Your defense is patching the library.
Document platform-specific risks: Create a register of platform-specific security considerations for your stack. Windows path handling is one. Character encoding differences are another. File permission models differ. Know where these gaps exist so you can test for them.
The Next.js vulnerabilities aren't sophisticated. They're the kind of bugs that emerge when a framework grows across platforms and accumulates dependencies. Your job isn't to prevent every library from shipping a buffer overflow. Your job is to patch fast when they do.
