August 2026 Security Release for Next.js
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.0, CVEs: CVE-2026-75604, Summary: Unauthenticated Remote Code Execution in the Image Optimization API when using AVIF (Critical Severity) GHSA-2xp9-vwfh-vxw4 / GHSA-g89c-p67h-r497 A vulnerability in the underlying libheif library used by sharp can lead to unauthenticated remote code execution when Next.js optimizes an attacker-controlled AVIF image. The patched releases disable AVIF optimization until…
CVSS 9.0 CVE-2026-75604 Vercel Next.js FI RO NL 3 zdrojů