For those in a hurry – update next.js to either 15.5.24 or 16.3.3 to mitigate these vulnerabilities.
Checkmarx SCA already supports detection of this vulnerability, it’s in our database, and scans will automatically flag applications running the affected versions, so customers using Checkmarx don’t need to hunt for this manuall; the exposure surfaces directly in their scan results.
Introduction
Almost a full year after React2Shell (CVE-2025-55182), a new critical Node server vulnerability has been unearthed. A new Critical vulnerability in Next.js has landed and making the rounds.
Another Critical vulnerability affecting the underlying libheif, when using AVIF for image optimization, has also been fixed in this update.
Next.js – Patched Versions:
15.5.24, 16.3.3, 16.4.0-canary.7
Next.js – Affected Versions:
13.4 through 15.5.23
15.6.0-canary.0 through 15.6.0-canary.61
16.0.x through 16.3.2
16.4.0-canary.0 through 16.4.0-canary.6
What is Happening
New versions of Next.js were released today to mitigate critical vulnerabilities in the popular JS framework. Of these vulnerabilities, various PoCs for exploiting the Windows vulnerability (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, Score 9.0) are already cropping up, which means active exploitation is likely already occurring where applicable.
According to the commit fixing this issue, this occurs because of a failure to validate backslashes (“\”), which are the directory delimiter on Windows, while Linux directory delimiters are slashes (“/”) and were properly sanitized.
“\” vs. “/” is a classic portability issue between Windows vs. Linux shells, often resulting in poor parity of security validation between the two – allowing one type of delimiter to bypass a security check or sanitization while the other passes freely, leaving one ecosystem exposed.
This vulnerability affects both the legacy Pages Router and the default App Router, unless Cache Components is enabled. Since that is not an explicitly safe measure of mitigation it is still not proper mitigation and does not negate the need for a prompt update.
While a Windows server running node with a next.js server is not a very common setup, and these installations must be the first to update, it is still highly recommended that all next.js users update to the latest version as soon as possible due to other issues affecting this version.
An additional vulnerability fixed in this release affects libheif – this fix disables AVIF optimization in next.js.
Mitigation
Update next.js to either 15.5.24 or 16.3.3, depending on your current major version, to mitigate this vulnerability.
This vulnerability is already covered by Checkmarx SCA, so if you’re scanning with Checkmarx, affected Next.js versions will be identified for you automatically as part of your regular scan results.
Conclusions
The pre-auth vulnerability and image optimization vulnerability affecting these versions of next.js are critical – while they both have their preconditions (such as running specifically on Windows), their severity warrants serious attention.
Vulnerabilities