Vercel Patches Pair of Unauthenticated RCE Flaws in Next.js Image Processing and Windows Routing

On August 25, 2026, Vercel released security updates for Next.js, publishing versions 15.5.24 and 16.3.3 to resolve two critical unauthenticated remote code execution vulnerabilities. The first flaw carries a CVSS score of 9.5 and stems from an underlying dependency in the `sharp` image optimization package. Specifically, `sharp` delegates AVIF image decoding to the C library `libheif`, which suffers from a memory corruption bug. When processing a crafted AVIF file containing two transparency layers of differing depths, `libheif` allocates memory based on the first layer but writes the larger second layer data, resulting in an attacker-controlled heap overflow of approximately 16 KB. This issue affects any application invoking `heif_decode_image()` within vulnerable `libheif` builds. Within Next.js, this affects versions 10.0.0 through 15.5.23 and 16.x up to 16.3.2, though AVIF optimization is disabled by default in `next.config.js`. The second vulnerability, tracked as CVE-2026-75604 with a CVSS score of 9.0, is a directory traversal flaw leading to remote code execution on Windows environments. Exploitation requires three specific conditions: the deployment must run on a Windows file system, rely simultaneously on both the Pages Router and the App Router, and run without Cache Components enabled. Versions 13.4 through 15.5.23 and 16.0 through 16.3.2 are affected by the traversal issue. Vercel confirmed that applications deployed directly on their managed cloud platform are not exposed due to backend Linux environments and proactive disabling of AVIF optimization.