Another Critical Web Framework Flaw: What Australian Businesses Need to Know

According to a report by The Hacker News, the popular web framework Next.js has released emergency patches for two critical vulnerabilities that allow attackers to run malicious code on unpatched servers. One flaw exploits how Next.js processes AVIF image files, while the other only affects Windows-based hosting environments. For Australian small and mid-sized businesses that rely on Next.js for their websites or customer portals, this is a serious reminder that even well-maintained software can hide dangerous weaknesses.

What makes this story significant is the combination of a widespread framework and the "no warning" nature of the exploits. The AVIF image bug can be triggered simply by uploading a specially crafted image, which is a common action on any site that accepts user photos or product images. The Windows path traversal flaw is equally dangerous because many Australian SMBs run their web servers on Windows due to its familiarity and ease of use. Together, these vulnerabilities expose a large attack surface that cybercriminals are already scanning for.

Why These Next.js Bugs Are a Wake-Up Call for Web Security

From an expert perspective, the most worrying aspect is how these flaws bypass traditional security layers. An unauthenticated remote code execution vulnerability means an attacker does not need a password or any special access to take control of your server. For a small business, losing control of your website can lead to stolen customer data, defacement, or even having your site used to attack others. The AVIF image processing flaw is particularly tricky because it lies in a third-party library (libheif) that most developers never directly manage. This highlights a growing trend: vulnerabilities in open-source dependencies are becoming a primary entry point for hackers.

Another key insight is the accelerated pace of disclosure. The source noted that vulnerability researchers are using AI-assisted tools to find bugs faster than ever. This means the gap between a flaw being discovered and a patch being released is shrinking, but so is the window for businesses to apply those patches. For Australian SMBs with limited IT staff, staying on top of these monthly security updates is now a business-critical task, not just a nice-to-have.

What This Means for Australian SMBs

For Australian small and mid-sized businesses, the real-world impact is immediate. Many local businesses use Next.js for e-commerce sites, booking systems, or client portals. If your site runs on a Windows server and uses Next.js versions between 13.4 and 15.5.23, or 16.0 to 16.3.2, you are at risk of an attacker silently taking over your server. The AVIF flaw affects a wider range of versions, but only if you have explicitly enabled AVIF image optimisation in your configuration. However, even if you haven't enabled it, you should verify your settings — many default configurations change over time.

Australian businesses also face unique challenges: compliance with the Notifiable Data Breaches scheme means that if customer data is stolen due to an unpatched vulnerability, you could face fines and reputational damage. The cost of a breach for an SMB can be devastating, often forcing closure. The good news is that patches are available and the vulnerabilities are not yet known to be actively exploited in the wild — but that window closes quickly.

What You Can Do Now

  • Update Next.js immediately. Run npm install [email protected] for the latest version, or npm install [email protected] if you are on the older LTS line. Do this on staging first, then production.
  • Check your server operating system. If your Next.js app runs on Windows, you must update right away — there is no workaround. Consider temporarily migrating static assets to a Linux-based host if you cannot patch immediately.
  • Review your image handling configuration. Open your next.config.js file and remove image/avif from the formats array if it is present. This disables the vulnerable AVIF optimisation path.
  • Enable automatic security notifications. Subscribe to the Next.js security mailing list or set up a tool that alerts you when new patches are released. Monthly updates are now the new normal.
  • Conduct a dependency audit. Run npm audit or a commercial scanner to identify all outdated libraries in your project. Many SMBs inherit old code that contains unpatched components.

Australian businesses don't have to handle these challenges alone. MS&VG regularly assists small and mid-sized clients with vulnerability assessments, patch management, and secure web development practices. If you need help securing your Next.js site or reviewing your overall cybersecurity posture, reach out to our team for tailored advice.