Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Summary
Vercel has released security patches for two critical vulnerabilities in the Next.js web framework. One vulnerability allows for remote code execution through specially crafted AVIF image files, while the other involves a path traversal flaw exploitable on Windows filesystems.
IFF Assessment
These vulnerabilities enable unauthenticated remote code execution, posing a significant risk to systems running the affected Next.js versions.
Severity
The CVSS score of 9.8 reflects the critical nature of these vulnerabilities, which allow for unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, likely exploitable over the network.
Defender Context
Defenders should prioritize patching Next.js instances immediately to mitigate the risks associated with these critical vulnerabilities. Staying vigilant about new exploits targeting image processing libraries and common web framework components is crucial for proactive defense.