Last week, 4 unauthenticated critical CVEs turned up in 24 hours, all sharing the same mistake: a component trusting the layer next to it
Read our technical analysis of these 4 critical CVEs
Within a single 24-hour window last week, four critical vulnerabilities landed across widely deployed infrastructure: two in Next.js, one in Netty, one in GitPython. All four are remotely reachable, all four require no authentication, and three of the four sit in code paths that are on by default.
The Next.js image optimizer routes attacker-supplied AVIF into a heap overflow in libheif for RCE in the server process; a second Next.js flaw escapes the incremental cache directory on Windows hosts, leaking the Server Actions encryption key; Netty’s ClientHello parser can be tricked into falling back to a permissive default TLS context, bypassing mTLS entirely; and GitPython turns dormant git-config values into live core.hooksPath directives on any unrelated write. Patched versions are available for all four.
Every one is the same story: two pieces of software that had blind trust – but neither one checked the other.
Affected Versions
| Affected Product | Versions | Patched Version | CVE/GHSA |
| GitPython | < 3.1.59 | 3.1.59 | CVE-2026-78676 |
| next (npm) | >= 10.0.0, < 15.5.24 | 15.5.24 | GHSA-2xp9-vwfh-vxw4 |
| next (npm) | >= 16.0.0, < 16.3.3 | 16.3.3 | GHSA-2xp9-vwfh-vxw4 |
| sharp (npm) | < 0.35.4 | 0.35.4 | GHSA-2xp9-vwfh-vxw4 |
| libheif | >= 1.22.0, <= 1.23.1 | 1.23.2 | GHSA-2xp9-vwfh-vxw4 |
| next (npm) | >= 13.4.0, < 15.5.24 | 15.5.24 | CVE-2026-75604 |
| next (npm) | >= 16.0.0, < 16.3.3 | 16.3.3 | CVE-2026-75604 |
| io.netty:netty-handler (Maven) | <= 4.1.136.Final | 4.1.137.Final | CVE-2026-75595 |
| io.netty:netty-handler (Maven) | >= 4.2.0.Final, <= 4.2.16.Final | 4.2.17.Final | CVE-2026-75595 |
Recommended Actions
Upgrade to the latest patched version.
Vulnerabilities Details
Critical Next.js Vulnerability Allows Unauthenticated Remote Code Execution via AVIF Image Optimization
GHSA: GHSA-2xp9-vwfh-vxw4
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
CVSS Source: GHSA
CVSS Base score: 9.5
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description: Next.js routes attacker-controlled AVIF input into libheif through its public, unauthenticated Image Optimization API, allowing remote code execution in the application server process. The endpoint sniffs the file type from magic bytes and hands anything absent from `BYPASS_TYPES` to sharp for decoding; AVIF was absent while its sibling HEIC was present, and the libvips loader allowlist kept `VipsForeignLoadHeif` reachable for AVIF specifically.
Critical Next.js Vulnerability Allows Unauthenticated RCE on Windows-Hosted Servers
CVE: CVE-2026-75604
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
CVSS Source: GHSA
CVSS Base score: 9.0
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description: Next.js builds incremental cache file paths by joining a route-derived cache key onto the server build directory without verifying that the result stays inside it. Dynamic route segments are escaped for the router’s own delimiters, forward slash, hash and question mark, along with their percent-encoded forms and the percent-encoded backslash, but not the literal backslash character. Because Windows treats the backslash as a path separator while POSIX treats it as a valid filename character, a catch-all route segment containing traversal sequences escapes the cache directory only on Windows-hosted servers. The incremental cache reads from and writes to that path, giving an unauthenticated attacker disclosure of files under the build directory, including the server reference manifest containing the Server Actions encryption key, and a write of attacker-influenced rendered output to a location of their choosing. Applications using Pages router or App router without Cache Components are affected.
`scale_nearest_neighbor()` reached through nested `iden` and `auxl` derived-item references that attach duplicate Alpha planes at mismatched bit depths, alongside eleven further out-of-bounds read and write issues in derived-item and pixel-plane handling.
Critical Netty Vulnerability Allows mTLS Bypass via Fragmented TLS ClientHello
CVE: CVE-2026-75595
CWE: CWE-475: Undefined Behavior for Input to API; CWE-754: Improper Check for Unusual or Exceptional Conditions
CVSS Source: GHSA
CVSS Base score: 9.1
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description: Netty’s `SslClientHelloHandler` parses the TLS ClientHello to extract the server name so that an `SslContext` can be selected per SNI hostname. The bounds check that should defer parsing until the 4-byte handshake header has arrived is computed from an offset that excludes the 5-byte TLS record header, leaving it five bytes short and unable to fire. When a fragmented ClientHello delivers a first record whose payload is under four bytes, the subsequent three-byte read of the handshake length addresses beyond the readable region and raises an `IndexOutOfBoundsException`, which a broad exception handler treats as an unparseable ClientHello and answers by selecting the default `SslContext`. An unauthenticated remote client can therefore choose the default context rather than the one its hostname maps to. Where mutual TLS is enforced solely through a per-SNI context with `clientAuth=REQUIRE`, the fallback context is permissive, and no peer-certificate verification exists at the application layer, this is an unauthenticated mutual TLS bypass.
Critical GitPython Vulnerability Turns Dormant Config Values Into Live Directives on Any Unrelated Write
CVE: CVE-2026-78676
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
CVSS Base score: 9.3
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
