Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-27 15:13 UTC
Importiert: 2026-09-03 11:55 UTC
CVSS: 9.0
Quelle-ID: thn_global
uid_hash: 83f1d8b7a2a702e49ce3760f7784bab45278a0ad6a77a8e311693f068d51c370

The Hacker News

Inhalt

Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.

The Windows path traversal, tracked as CVE-2026-75604&

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-75604	CRITICAL	9	CRITICAL	9			2026-09-01

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste