Next.js patches critical vulnerabilities that can let attackers run code through AVIF handling and Windows systems

Next.js released security fixes for critical flaws that could let attackers run malicious code on vulnerable servers without logging in. The issues include an AVIF image-processing vulnerability and a Windows-specific flaw affecting Next.js deployments; the article says the bugs can lead to unauthenticated remote code execution and were patched by the framework maintainers in updated releases. Organizations using affected Next.js versions should review the vendor advisory for exact patched versions and exposure conditions.