Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using self-hosted Next.js applications
Incident: Discovery and patching of two critical unauthenticated RCE vulnerabilities in the Next.js framework.
Impact: Full system compromise and unauthorized remote code execution on affected servers.
Attacker: Unidentified threat actors
Analysis: Two critical vulnerabilities in the Next.js framework enable unauthenticated remote code execution. One stems from a heap buffer overflow in the libheif library during AVIF image optimization, while the other involves a path traversal vulnerability specific to Windows-based servers. Both flaws allow for complete system compromise if left unpatched in self-hosted deployments.
Recommendations: Update Next.js to version 15.5.24 (LTS) or 16.3.3 (Active LTS) immediately.; Audit self-hosted Windows servers for Next.js deployments using Pages or App Router.; Verify that image processing dependencies are updated to the latest secure versions.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source