Loading today’s stories
Security1 distinct publisher3 min readPublished
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The libheif overflow is checkable against your own configuration, so start there. A crafted AVIF file carrying nested identity-derivation and auxiliary item references makes libheif assemble a decoded image with two Alpha plane entries at different bit depths [14]. The scaler then allocates a destination buffer sized for the first entry, which is 8-bit, and writes 16-bit sample values from the second entry into that same buffer [15]. Two bytes for every one budgeted [17], with the overrun put at roughly 16,384 bytes past the allocation boundary [15], or 16 KiB of heap written past the end [16]. rootxharsh and KarimPwnz released a Python proof-of-concept that reproduces the corruption under an address sanitizer build [18].
What the proof-of-concept shows is the out-of-bounds write [21]. The line in the libheif advisory, "We were able to get RCE using this on multiple applications" [20], has not been independently corroborated [21]. The credits diverge as well: the libheif advisory names rootxharsh as Finder and KarimPwnz as Coordinator, while Vercel's changelog attributes the disclosure to the Hacktron team [19].
Exposure on the AVIF path comes down to one line of config. Next.js enables AVIF optimization only where a site has explicitly added image/avif to its formats configuration in next.config.js [22], so checking exposure is a search through source rather than a scan of hosts. The fix is a removal: the patched releases turn AVIF optimization off entirely until the upstream libheif fix propagates [23], which means sites that had configured it give up the format in order to take the patch [30]. libheif v1.23.2 was still unpublished when The Hacker News checked the project's releases page on August 27, 2026 [24], two days after the Next.js releases went out [25].
The Windows bug has no equivalent gate. Vercel did not disclose the attack mechanism [8], so there is no request pattern to filter at the edge and no signature to write, and the advisory's instruction, no known workaround and upgrade immediately if your server is hosted on Windows [4], is the whole of the remediation. The affected range runs 13.4 through 15.5.23 and 16.0 through 16.3.2 [7], four major lines [31], and the move is npm install [email protected] or npm install [email protected] [32]. Vercel credited evolutionstorm and B0RI with the disclosure [9].
August was the second release under the monthly security program Vercel announced in July 2026 [27]; the first, on July 21, carried nine fixes in 16.2.11 and 15.5.21 [28]. This one shipped on the 25th rather than the scheduled 26th after Vercel identified another critical vulnerability in an upstream dependency [26]. Andrew Imm and Josh Story wrote on July 13 that research volume across the industry is "rising fast, driven by LLM-assisted discovery" [29]. A fixed monthly train that has to move for a C library two hops down the stack, Next.js to sharp to libheif [10], is what that pressure looks like on a release calendar.
Ranked by verification strength, evidence, and original report placement.
Vercel released security patches for two critical-severity vulnerabilities in the Next.js web framework, both allowing unauthenticated remote code execution: one exploitable via specially crafted AVIF image files, the other a path traversal affecting servers using a Windows filesystem.
The Windows path traversal is tracked as CVE-2026-75604 with a CVSS score of 9.0, and affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem.
Linux and macOS deployments are not affected by the path traversal flaw.
Vercel advisory: "There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows."
Fixes are available in Next.js 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS), published on August 25, 2026.
Applications hosted on Vercel are protected from both vulnerabilities and require no upgrade, Vercel said in a changelog entry published August 25.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 27, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
Next.js patches two Critical bugs: Windows hosts must upgrade, AVIF reaches everyone else1 distinct publisher
build
With CRA out of React's docs, the new project default is a rendering decision1 distinct publisher
build
canvas.toBlob hands you a PNG and calls it WebP: check blob.type, not the user agent1 distinct publisher
build
The MCP test that matters: a log tool that fetched the data and then said it failed1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Vendor and upstream advisories with a public PoC, one flaw's mechanism withheld
The technical record is specific and traceable: a CVE with a CVSS score, two GHSA identifiers, precise affected version ranges for both flaws, a described allocation/bit-depth mismatch with a quantified ~16 KiB overrun, and a published Python PoC that reproduces heap corruption under ASan. Two things cap the score: the Windows traversal's attack mechanism was not disclosed at all, and the researchers' RCE-on-multiple-applications claim rests on their own advisory statement rather than corroboration. All of it also reaches us through a single secondary publisher, though that publisher independently checked the libheif releases page.
Fixes shipped and platform-mitigated; downstream uptake unmeasured
There are concrete, dated artifacts: two patched LTS releases on August 25, a mitigation applied on Vercel's own hosting, and a prior July 21 release under the same program. But nothing in the material measures how many affected deployments have upgraded, how many run on Windows filesystems, or how many opted into image/avif, and the upstream libheif fix had not shipped at all. Adoption is therefore real on the supply side and unknown on the consumption side.
Slightly overstated: severity framing outruns disclosed mechanics and any exploitation data
The framing of unauthenticated RCE for anyone who can reach a Windows-hosted app leans on vendor CVSS scores while the Windows attack mechanism is undisclosed, no exploitation has been reported, and the RCE claim on the AVIF path is explicitly uncorroborated. Exposure is also narrower than a headline suggests — Linux and macOS are exempt from the traversal, and AVIF requires an explicit config opt-in. The gap is small rather than large because the reporting itself surfaces each of these limits and the underlying artifacts (CVE, GHSA, PoC, patched releases) are real.
Vendor is also the hosting provider; researcher and outlet incentives visible
Vercel simultaneously maintains Next.js, sells hosting for it, and authors the advisory that says its own platform needs no upgrade while Windows self-hosters have no workaround — a disclosure with commercial gravity. The mitigation chosen (disabling AVIF rather than shipping a parser fix) also serves speed of release over feature preservation. On the research side, a public PoC and an unverified RCE claim carry reputational upside, and the credit discrepancy between the libheif advisory's individuals and Vercel's Hacktron attribution shows attribution is itself contested territory. The publisher's incentive is severity-driven security coverage, partly offset by its own verification and its note that Vercel did not respond to comment.
Single publisher relaying primary advisories, with one independent check
Confidence is moderate: the factual spine — identifiers, scores, version ranges, release dates, quotes — comes from named primary documents (Vercel advisory, changelog and security blog; libheif advisories) and the publisher verified the missing libheif release itself. It is held down by having only one publisher in the cluster, no vendor response to a comment request, no independent reproduction of the RCE claim, and no exposure or uptake measurement of any kind.