importantSYS.SOURCE: The Hacker News• 2026-08-27T20:43:00+05:30

Next.js Addresses Critical AVIF and Windows-Based RCE Vulnerabilities

#vulnerability #web security #software security

Next.js has addressed two critical vulnerabilities enabling unauthenticated remote code execution (RCE), one via malicious AVIF images and another through a Windows path traversal flaw, with patches released for affected versions. The Windows-specific flaw (CVE-2026-75604, CVSS 9.0) requires immediate upgrades for Windows-hosted applications, while the AVIF issue involves a heap buffer overflow in libheif affecting image processing.

Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.

The Windows path traversal, tracked as CVE-2026-75604&

Read original article

*** END OF TRANSMISSION ***

> EVALUATING AI AGENTS ON SCIENTIFIC RESEARCH WORKFLOWS VIA TERMINAL-BENCH-SCIENCE > ANTHROPIC AND OPENAI TO PRESENT AT TECHCRUNCH DISRUPT 2026 AI STAGE > EXPLORING WEB INTEROPERABILITY AND OPEN STANDARDS IN SOCIAL MEDIA > OPENTIE AND OPENXWA: OPEN-SOURCE REIMPLEMENTATIONS OF STAR WARS FLIGHT SIMULATORS > FRAMEWORK-FREE RAG, AGENTS, AND EVALS TRAINING MATERIALS FOR AI ENGINEERS USING COLAB > OPEN SOURCE MODEL GATEWAY OPTIMIZES AI MODELS THROUGH USAGE DATA > RIVIAN'S CFO CLAIRE MCDONOUGH RESIGNS TO JOIN GE VERNOVA, STEPS DOWN IN OCTOBER > BLUESKY INTRODUCES ALGORITHMIC OPT-OUT FEATURE TO LIMIT POST VISIBILITY IN DISCOVER FEED > META'S $18B SETTLEMENT INCLUDES LEGAL EXEMPTION FOR CHILDREN'S DATA HANDLING > YOUTUBE INTEGRATES AMAZON PRODUCT TAGGING FOR CREATOR MONETIZATION> EVALUATING AI AGENTS ON SCIENTIFIC RESEARCH WORKFLOWS VIA TERMINAL-BENCH-SCIENCE > ANTHROPIC AND OPENAI TO PRESENT AT TECHCRUNCH DISRUPT 2026 AI STAGE > EXPLORING WEB INTEROPERABILITY AND OPEN STANDARDS IN SOCIAL MEDIA > OPENTIE AND OPENXWA: OPEN-SOURCE REIMPLEMENTATIONS OF STAR WARS FLIGHT SIMULATORS > FRAMEWORK-FREE RAG, AGENTS, AND EVALS TRAINING MATERIALS FOR AI ENGINEERS USING COLAB > OPEN SOURCE MODEL GATEWAY OPTIMIZES AI MODELS THROUGH USAGE DATA > RIVIAN'S CFO CLAIRE MCDONOUGH RESIGNS TO JOIN GE VERNOVA, STEPS DOWN IN OCTOBER > BLUESKY INTRODUCES ALGORITHMIC OPT-OUT FEATURE TO LIMIT POST VISIBILITY IN DISCOVER FEED > META'S $18B SETTLEMENT INCLUDES LEGAL EXEMPTION FOR CHILDREN'S DATA HANDLING > YOUTUBE INTEGRATES AMAZON PRODUCT TAGGING FOR CREATOR MONETIZATION