Next.js 15.5.24 and 16.3.3 Patch Windows Path Traversal CVE-2026-75604 and libheif AVIF Heap Overflow Enabling Unauthenticated RCE

The Windows flaw affects Pages and App Router deployments without Cache Components on NTFS hosts; Linux and macOS are unaffected. No workaround exists. Technical evidence consists solely of the advisory and researcher credits to evolutionstorm and B0RI; no public PoC or packet capture has surfaced. The AVIF issue stems from libheif versions through 1.23.1 mishandling nested identity-derivation items, producing a 16-kilobyte out-of-bounds write during 8-to-16-bit alpha scaling. A Python PoC released by rootxharsh reproduces the corruption under ASAN, yet the researchers' claim of RCE on multiple applications lacks independent confirmation.

Next.js image optimization only processes AVIF when explicitly enabled in next.config.js, limiting exposure. The patches disable AVIF support until libheif 1.23.2 ships. This pattern mirrors prior image-pipeline failures in sharp and libvips where upstream C libraries introduced heap issues that frameworks inherited without additional sandboxing. Vercel moved the release forward one day after discovering the second dependency flaw, indicating internal scanning caught the issue but did not prevent the original disclosure window.

Applications hosted on Vercel are already protected. Self-hosted Windows instances require immediate upgrade; those relying on AVIF must also update libheif or disable the format. Future risk centers on similar upstream C dependencies in other frameworks that perform untrusted image decoding without memory-safe wrappers.