Next.js Critical Windows and AVIF Unauthenticated RCE Threat Hunt

Threat Overview

Vercel released Next.js 15.5.24 and 16.3.3 on August 25, 2026 to address two critical unauthenticated remote-code-execution vulnerabilities.

CVE-2026-75604 affects Windows-hosted Next.js applications using both the Pages Router and App Router without Cache Components. GHSA-2xp9-vwfh-vxw4 affects Next.js image optimization when attacker-controlled AVIF files are processed through sharp/libheif. No confirmed in-the-wild exploitation was reported in the reviewed vendor advisories.

References

• The Hacker News — August 27, 2026
• Vercel / GitHub — CVE-2026-75604 — August 25, 2026
• Vercel / GitHub — AVIF RCE advisory — August 25, 2026
• Next.js Security Release

Impacted Systems

Vendor / Product	Vercel Next.js
Windows RCE	CVE-2026-75604
Windows affected versions	>=13.4 and <15.5.24; >=16.0 and <16.3.3
Windows prerequisites	Windows filesystem; Pages Router and App Router; Cache Components not enabled
AVIF RCE	GHSA-2xp9-vwfh-vxw4; no CVE assigned in reviewed vendor advisory
AVIF affected versions	>=10.0.0 and <15.5.24; <16.3.3
Patched versions	15.5.24 and 16.3.3
Linux/macOS	Not affected by CVE-2026-75604; AVIF issue is separate and cross-platform when vulnerable image optimization is used
Vercel-hosted apps	Vercel states its platform is not affected by the Windows filesystem path
Known exploitation	No confirmed in-the-wild exploitation in reviewed vendor advisories

What this hunt looks for

Looks for traversal-style requests to self-hosted Next.js applications, AVIF requests through /_next/image, and suspicious shell or scripting processes spawned by node.exe.

Required logs

CommonSecurityLog or equivalent WAF/reverse-proxy/web-server telemetry; DeviceProcessEvents on self-hosted Next.js servers.

First-Pass — Traversal-Style Requests to Next.js

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("..%5c","..%5C","%2e%2e%5c","%2e%2e%5C",@"..\")
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, DeviceAction
| sort by TimeGenerated asc

Follow-Up — AVIF Requests Through Next.js Image Optimization

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has "/_next/image"
| where RequestURL has_any (".avif","image/avif","%2Eavif","%2eavif") or Message has "image/avif"
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(RequestURL,50), UserAgents=make_set(RequestClientApplication,20) by SourceIP, DestinationHostName
| sort by Requests desc

Follow-Up — node.exe Spawning Shells or Scripting Engines

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("node.exe","node")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","bash","sh","curl.exe","wget.exe","python.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc