ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Next.js

0 mentions in 7 days · 3 in 30 days · 3 total · first seen · last

Search everything

Timeline

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.

Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.

Full Disclosure · 12d agoVulnerability

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.

The Hacker News · 19d agoVulnerabilityCVE-2026-75604

Next.js security advisory (AV26-851)

Canada's Cyber Centre warns Next.js 15.5 and 16.3 are affected by critical vulnerabilities; users should update to 15.5.24 and 16.3.3.

The Canadian Centre for Cyber Security (AV26-851) warns that Next.js versions 15.5 prior to 15.5.24 and 16.3 prior to 16.3.3 are affected by critical vulnerabilities. Administrators are urged to review the vendor advisory and apply the August 2026 security release updates. The bulletin provides no CVE ids or exploitation details.

Canadian Centre for Cyber Security · 20d agoAdvisory

Related CVEs

  • CVE-2026-756049.02%
    Unauthenticated RCE in Next.js on Windows-hosted servers
    Next.js, the widely used React web framework published on npm, contains an unauthenticated remote code execution vulnerability classified as CWE-22 (path traversal) and rated critical at CVSS 9.0. The flaw affects applications built with the Pages Router or App Router that do not use Cache Components, and it is triggered only when the server runs on a machine with a Windows filesystem; a remote, unauthenticated attacker can reach it over the network, though exploitability is rated high attack complexity. Successful exploitation yields code execution with high impact to confidentiality, integrity, and availability, and the scope is changed, meaning impact extends beyond the vulnerable component. Only teams self-hosting Next.js on Windows servers are affected; deployments on Linux, macOS, or Vercel's managed infrastructure are not. There is currently no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns a 1.1% probability of exploitation within 30 days, but no workaround exists, so upgrading is the only mitigation.
    · Vercel Next.js — applications using the Pages Router (without Cache Components) on Windows-hosted servers · Vercel Next.js — applications using the App Router (without Cache Components) on Windows-hosted serversmoderate

Appears with

vendor Vercel 2organization Hacktron 1organization Vercel 1product libheif 1organization Canadian Centre for Cyber Security 1vendor Canadian Centre for Cyber Security 1vendor libheif 1vendor Next.js 1product sharp 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.