Vercel has released security patches for two critical vulnerabilities in the Next.js web framework, both allowing unauthenticated remote code execution. CVE-2026-75604, a path traversal flaw, affects Windows filesystems, while another is exploitable via specially crafted AVIF image files. Developers using Next.js should update immediately to prevent server compromise.