55
55
30
30
55
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).
Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.
68
55
55
42
30
30
47
47
60
30
55
35
30
Datasette 1.0a39 and 0.65.4 security releases
Datasette shipped security patches 1.0a39 and 0.65.4 fixing subtle bugs in instances mixing public and private tables, found via an AI-assisted audit.
Datasette released parallel security fixes for its current alpha series (1.0a39) and stable 0.65.x family (0.65.4), advising anyone running a Datasette instance on the public web to update, especially where public and private tables are mixed. The underlying issues were reported by Sevban Dönmez and Alex Garcia, followed by an extensive audit of the codebase using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. Fixes were developed and reviewed collaboratively over nearly a week. No CVE identifiers or observed exploitation are mentioned in the announcement.
25
30
55
55
55
60
42
30
60
55
55
55
55
30
30
30
30
55
60
Google Patches Chrome zero
60
60
30