Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal, tracked as CVE-2026-75604&

Report facts: Vercel has patched two critical vulnerabilities in the Next.js web framework that enabled unauthenticated remote code execution, one via maliciously crafted AVIF image files and another via a Windows-specific path traversal issue. These flaws affect servers running Next.js and could allow attackers to execute arbitrary code without authentication. RealGround analysis: For organizations that rely on Next.js within AI products or agent backends, this highlights AI supply chain exposure where vulnerabilities in underlying web frameworks can compromise AI systems even if models themselves are secure. Teams should ensure timely framework patching, maintain accurate SBOMs for AI applications, and include dependency vulnerability monitoring and patch verification in their AI security readiness processes.