Next.js Patches Two Critical RCE Vulnerabilities in Versions 15.5.24 and 16.3.3
Next.js has received a security update to fix two critical vulnerabilities that can lead to remote code execution without authentication. The patches were made available in versions 15.5.24 and 16.3.3.
The first flaw, CVE-2026-75604, received a CVSS score of 9.0 and affects applications hosted on Windows servers that use Pages Router or App Router without Cache Components. The issue is related to path traversal. An attacker can manipulate paths processed by the application and, under specific conditions, achieve code execution on the server without requiring credentials or user interaction. Vulnerable versions include those from 13.4 up to but not including 15.5.24, as well as the 16.0 line up to but not including 16.3.3. There is no workaround for affected Windows servers.
The second vulnerability targets the Image Optimization API when AVIF files are processed. A specially crafted malicious AVIF file can exploit the image processing pipeline and result in code execution. This flaw affects versions from 10.0.0 up to releases prior to 15.5.24, plus versions 16 prior to 16.3.3.
Administrators should update dependencies, rebuild containers, and confirm that production environments run Next.js 15.5.24 or 16.3.3 or later, with priority given to Windows servers and applications that process user-submitted images.
Related articles
Weekly Roundup: Next.js Leads Critical Vulnerability Reports as Chrome, Tomcat, and PostgreSQL See Major Patches
Security NEXT has published its list of the ten most-read articles for the week of August 23-29, 2026. The top story covered multiple serious vulnerabilities in Next.js that prompted an accelerated release schedule. Other high-interest items included a critical flaw in Zscaler Client Connector, several issues in Apache Tomcat rated critical, and Google’s Chrome 152 update fixing 327 vulnerabilities. Additional reports highlighted a ransomware incident at a systems development firm, flaws in SKYSEA Client View, 28 vulnerabilities fixed in PostgreSQL, and confirmed exploitation of six known flaws in SQL Server and NetScaler. The list also featured a vulnerability in the Android version of the Digital Agency’s My Number Point app and warnings about active exploitation of a WebLogic module flaw.
Multiple Critical Vulnerabilities in Langflow Enable Remote Code Execution
IBM disclosed three severe vulnerabilities in the open-source Langflow project on August 24, 2026. The flaws affect server instances and allow attackers to execute arbitrary code under specific conditions. CVE-2026-19286 is a code injection issue in the Agent-to-Agent (A2A) public endpoint that bypasses existing restrictions when authentication is disabled. CVE-2026-19295 permits authenticated users to evade custom component restrictions via eval injection in flow templates, leading to OS-level command execution. CVE-2026-18729 stems from insufficient input validation and lets low-privileged authenticated users bypass protected paths to run arbitrary code on the server. Patches addressing all three issues are now available.
ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow has released security updates addressing four vulnerabilities in its AI platform, including three rated CVSS 10.0. The flaws enable unauthenticated attackers to achieve remote code execution, privilege escalation, and arbitrary SQL execution against core ITSM systems used by large enterprises worldwide. Affected components include the GraphQL Composite Data API, system configuration image upload processor, and dynamic schema ORDER BY handling. ServiceNow states it has patched hosted instances and provided hotfixes for self-hosted customers running Xanadu, Yokohama, Zurich, and Australia branches. This follows a July disclosure of a related sandbox escape tracked as CVE-2026-6875 that showed signs of in-the-wild exploitation. No public exploits or confirmed active attacks have been observed for the new issues yet, but the extremely low attack complexity leaves a narrow remediation window for organizations running exposed instances.
AI Agent Uncovers Unauthenticated Router Config Dump Leading to CVE Filing
An LLM agent tasked only with documenting network topology independently discovered a critical authentication bypass in a home router firmware. The agent performed read-only reconnaissance, extracted the full configuration including base64-encoded admin passwords and WPA2 keys via an unprotected CGI endpoint, and verified the finding by obtaining a valid session cookie. It then produced a complete coordinated disclosure report, classified the issue under CWE-306 with a CVSS 3.1 score of 8.8, and prepared the MITRE CVE submission package. The vulnerability affects LAN-side management interfaces of certain SOHO routers running legacy Boa web servers and remains unpatched due to inaccessible vendor firmware channels. The researcher maintained strict read-only permissions for the agent throughout the process, ensuring no configuration changes occurred. The case demonstrates how autonomous agents can accelerate vulnerability research while staying within defined operational boundaries.