Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has released patches for two critical vulnerabilities in the Next.js web framework that allow unauthenticated remote code execution. One vulnerability can be exploited through specially crafted AVIF image files, while the other is a path traversal flaw affecting Windows filesystems. The Windows path traversal issue has been assigned a CVE identifier. These vulnerabilities enable remote code execution without authentication. The patches address these critical-severity flaws in Next.js.