Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Next.js has released security patches to address two critical vulnerabilities. The first, a Windows path traversal flaw, allows unauthenticated remote code execution when processing specially crafted AVIF images. The second, a heap buffer overflow in the libheif C library used for AVIF image optimization, also leads to remote code execution. Both vulnerabilities have been actively researched and exploited in similar environments, and Vercel has accelerated its security release schedule to address them. Users of affected Next.js versions should upgrade immediately.