Vulnerability

Philips reports no product impact from Next.js flaw CVE-2026-75604

MedDevice Cyber Staff · 3 days ago · 3 min read · Via Philips product security advisories

Philips published a product security advisory on September 4 for CVE-2026-75604, a path traversal in the Next.js web framework that carries a base score of 9.0. The company says no Philips products are known to be impacted at this time, and that it continues to analyze the issue. The CVE record went public three days earlier, on September 1.

The flaw sits in the Next.js cache layer on Windows hosts. Remote requests can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key, which opens a route to remote code execution. Versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2 are affected. Vercel fixed it in 15.5.24 and 16.3.3, released August 25. Linux and macOS deployments are not affected, and the advisory lists no workaround for Windows hosted applications. Researchers evolutionstorm and B0RI are credited in the changelog.

That same August 25 release closed a second critical flaw, GHSA-2xp9-vwfh-vxw4, a heap buffer overflow scored 9.5 that a crafted AVIF file reaches through Next.js image optimization. The overflow lives upstream in libheif, tracked as GHSA-g89c-p67h-r497 in version 1.23.1 and earlier, and it only fires on sites that added image/avif to the formats configuration in next.config.js. rootxharsh reported it, with KarimPwnz coordinating.

A device does not have to run Next.js for a Next.js CVE to become a regulatory question. The framework turns up in clinician portals, remote monitoring consoles, service dashboards, and the cloud front ends that increasingly sit inside the device boundary under section 524B. Once a component named in the SBOM picks up a published advisory, the manufacturer owes an impact assessment regardless of what the answer turns out to be.

Philips posted its assessment three days after the CVE went public, and that interval is the number worth benchmarking against. The work that makes a three day answer possible happens well before the advisory lands: a build time SBOM that names transitive components, and a query that maps a CVE to shipped product versions without a manual survey. Teams without that query end up running it over email, and the clock does not stop while they wait for replies.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Move self hosted Next.js applications to 15.5.24 or 16.3.3. There is no workaround for Windows hosted deployments, so the version bump is the fix, and any Windows host running 13.4.0 through 15.5.23 or 16.0.0 through 16.3.2 should be treated as exposed until it lands. Sites that enabled AVIF image optimization need the same upgrade to close the libheif heap overflow. Ask every vendor whose portal or console touches your clinical network which Next.js version it runs.

Upgrade the framework. Move self hosted Next.js applications to 15.5.24 or 16.3.3. Windows hosts have no workaround, so nothing short of the upgrade removes the exposure.
Find every instance you ship or host. Search build manifests and container images for Next.js, including the copies behind vendor portals, service dashboards, and internal tools nobody owns on paper.
Drop AVIF where nothing needs it. The libheif heap overflow only reaches sites that added image/avif to the formats configuration in next.config.js. Removing that entry shrinks exposure while the upgrade is scheduled.
Separate build secrets from cache paths. A cache root that holds manifests with encryption keys turns any path traversal into key disclosure. Store build secrets outside any directory a request-scoped path can address.

For Device ManufacturersFix the class in the product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-75604 in the Next.js framework?

CVE-2026-75604 is a path traversal vulnerability in Next.js versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2, scored 9.0. On Windows hosts, remote requests can supply encoded path separators that traverse outside the cache root and expose private build data, including the server-reference-manifest encryption key, which can lead to remote code execution. Vercel fixed it in 15.5.24 and 16.3.3.

Are Philips products affected by the Next.js vulnerability CVE-2026-75604?

Philips said in its September 4, 2026 product security advisory that no Philips products are known to be impacted at this time, and that it continues to monitor and analyze CVE-2026-75604. Philips said it will update its Product Security Advisory page if that assessment changes.

Which Next.js versions fix CVE-2026-75604 and the AVIF heap overflow?

Next.js 15.5.24 and 16.3.3, released August 25, 2026, fix both CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4, the AVIF heap buffer overflow scored 9.5 that originates in libheif 1.23.1 and earlier. There is no workaround for Windows hosted applications affected by CVE-2026-75604.

← Back to Vulnerabilities