Published on August 31, 2026 · The mitza.es team
Vercel, the company behind Next.js — one of the most widely used frameworks today for building websites and apps with React — has released patches for nine vulnerabilities detected in the framework. Among them are high- and medium-severity flaws including server-side request forgery (SSRF), a middleware authentication bypass, denial of service, and sensitive data exposure.
The most severe flaw: path traversal on Windows
CVE-2026-75604, rated 9.0 out of 10 on CVSS, is a path traversal flaw affecting Next.js applications running on Windows file systems, specifically through the image optimization API when processing AVIF files. An attacker can exploit this flaw to access files outside the directory the application intended to expose.
React2Shell: unauthenticated remote code execution
Beyond the nine Next.js vulnerabilities, researchers also identified CVE-2026-55182, known as React2Shell, a critical flaw that allows remote code execution without any authentication in applications using React Server Components. It's the most severe kind of vulnerability a web application can have: it requires neither a password nor any prior access.
Which versions are affected
Patches are available in Next.js versions 15.5.21 and 16.2.11. An important detail: versions 13.x and 14.x will not receive direct patches, so any project still on those versions needs to update straight to the 15.x or 16.x branch to be protected.
Why this matters even if your website isn't hosted on Vercel
Next.js is used across thousands of projects hosted on very different infrastructure, not just Vercel. If your website or application runs an active Next.js server (unlike a static export, which doesn't run this kind of server-side logic in production), these vulnerabilities affect you just as much as any other project on the same framework, regardless of who hosts it.
What to check if you manage a Next.js project
- Check which version of Next.js your project is on and update as soon as possible if you're still on 13.x or 14.x.
- Check whether your application uses the image optimization API with AVIF files on a Windows server.
- If you use React Server Components, prioritize the update that fixes React2Shell.
- Apply the same principle we've seen with other critical vulnerabilities this year: updating quickly drastically shrinks the exposure window.
Technical maintenance, once again the foundation of everything
This ties into the same underlying message we already shared about the Windows vulnerabilities and WordPress this same year: the framework or system holding up your website needs active review, not just attention at launch. At Mitza we work on custom web development with exactly this kind of maintenance built in, and if you want to know the technical state of your current project, you can request an audit.