Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal, tracked as CVE-2026-75604&

thehackernews.com ·3h ago

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

We haven't written up this one. The Hacker News has the full story — the link below goes straight to it.

Read the original at thehackernews.com →

More in Tech

Holy crap, it's happening: Dwarf Fortress gets its first Myth and Magic update later this year, bringing each player's world its own procedural magic system

"Everything that makes fantasy what it is—with every piece tied into how that particular universe works, down to its bones."

3h ago ·pcgamer.com

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine.

3h ago ·thehackernews.com

Almost 20 years later, Arkane's founder says he understands why Valve cancelled the Ravenholm game that never was: 'It all came down to the economics'

"We grew up and got a little bit more mature about it."

3h ago ·pcgamer.com

This Echo Show 15 deal drops Amazon’s 15.6-inch smart display to $269.99

The newest Echo Show 15 gets a 23% discount, bringing Alexa, Fire TV, and smart home controls to one big display.

3h ago ·androidauthority.com

Redmi Note 17 Pro Series Goes Global With Massive 10,000mAh Battery

Xiaomi has officially launched the Redmi Note 17 Pro and Redmi Note 17 Pro Max globally, bringing significantly larger batteries, … Read More The post Redmi Note 17 Pro Series Goes Global With Massive 10,000mAh Battery appeared first on ProPakistani .

3h ago ·propakistani.pk

UK says ‘no’ to backdoors, but the government isn’t listening

It doesn’t matter what the UK government says, the majority of the UK public is reluctant to hand over additional surveillance powers that require tech companies to build backdoors to access encrypted communications. That’s based on a poll release Thursday by the Center for Democracy and Technology (CDT), a US-based advocacy group.

3h ago ·computerworld.com