Somewhere out there, a perfectly innocent AVIF image was quietly weaponized. Not by a hacker in a hoodie typing furiously in a dark room — just by existing, uploaded to a Next.js site that hadn't patched yet. That's the kind of week Next.js developers have had.
Two Bugs, One Very Bad Week for Sharp
Vercel disclosed and patched two critical vulnerabilities in Next.js this week. The nastier one is a heap buffer overflow in libheif, the C library that Next.js's image pipeline (via the sharp package) uses to decode AVIF images — CVSS 9.5, and it triggers the moment your server processes an attacker-controlled image. The second, CVE-2026-75604, is a Windows path traversal flaw (CVSS 9.0) that opens the door to unauthenticated remote code execution on Windows-hosted Pages and App Router apps not using Cache Components.
Both affect a huge swath of the ecosystem — Next.js 13.4 through 15.5.23, and 16.0 through 16.3.2. Fixes landed in 15.5.24 and 16.3.3 on August 25, and Vercel says it already shielded its own managed Image Optimization service before going public. No exploitation in the wild has been confirmed yet, which is the closest thing to good news in this story.
Why "No Exploits Yet" Isn't a Plan
Next.js isn't a niche framework — it's the backbone of an enormous number of production marketing sites, storefronts, and dashboards, many of which quietly self-host and never touch Vercel's managed protections. "Unauthenticated RCE" means an attacker doesn't need a login, a password, or your goodwill — just a URL and an image upload field.
The real lesson here isn't "Next.js bad." It's that image processing, one of the most mundane-seeming features on any website, keeps turning out to be a favorite attack surface because so few teams treat it as one. Patch cadence on frameworks like this needs to be a standing habit, not a fire drill.
A CVSS 9.5 bug hiding inside "resize the thumbnail" is the internet reminding you that boring code still needs grown-up supervision.
If your dev team can't tell you the last time your framework dependencies were audited, that's the conversation to have before your image upload form becomes someone else's exploit — grab our free developer's security checklist to start that audit yourself: Free Security Checklist.
Source: The Hacker News