Next.js Patches Two Critical AVIF and Windows Vulnerabilities Enabling Unauthenticated RCE

Vercel released security patches for two critical vulnerabilities in Next.js that enable unauthenticated remote code execution. One vulnerability involves specially crafted AVIF images, while the other is a path traversal flaw affecting servers that use a Windows filesystem. No exploitation of either August vulnerability had been reported as of August 27, 2026.