CVE-2026-75604: Next.js Windows Path Traversal and AVIF Image Flaws Enable Unauthenticated Code Execution — Detection and Remediation Guide

---
title: Next.js Node Process Spawning Shell or Script Interpreter
id: 3f8a1c52-7b2d-4e91-a6c4-9d5e2f8b1a07
status: experimental
description: Detects node.exe or node spawning command shells, PowerShell, or script interpreters, consistent with post-exploitation activity following remote code execution in a Next.js server such as CVE-2026-75604 or the AVIF parsing flaw.
references:
  - https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build pipelines and CI/CD agents running Node.js build scripts that legitimately invoke shells (scope these by host or service account)
  - PM2 or similar process managers performing controlled restarts
level: high
---
title: Suspicious Path Traversal Sequences in Web Server Request URI
id: 8c2e5b14-4d6f-4a38-b9e1-7c3d9a2f5e68
status: experimental
description: Detects URL-encoded and mixed-separator Windows path traversal sequences in HTTP request URIs targeting Next.js routes, consistent with exploitation of CVE-2026-75604 against Windows-hosted Next.js servers.
references:
  - https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri|contains:
      - '..%5c'
      - '..%255c'
      - '..%2f'
      - '..%252f'
      - '..\\'
      - '%2e%2e%5c'
      - '%2e%2e/'
      - '..;/'
  selection_nextjs:
    cs-uri|contains:
      - '/_next/'
      - '/api/'
  condition: selection_traversal or (selection_nextjs and selection_traversal)
falsepositives:
  - Vulnerability scanners and authorized penetration tests (correlate with known scanner source IPs)
level: high
---
title: Suspicious AVIF File Dropped in Web-Writable or Temp Directories
id: 5a1d9f36-2e8b-4c47-9d3a-6f4b8e1c7a29
status: experimental
description: Detects creation of AVIF image files in temporary, cache, or upload directories on Windows systems, which may indicate staged payloads targeting the Next.js AVIF image parsing vulnerability.
references:
  - https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
      - '\uploads\'
      - '\inetpub\'
  selection_ext:
    TargetFilename|endswith: '.avif'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate image processing workloads; baseline directories used by your Next.js image cache and tune accordingly
level: medium

// Hunt 1: Node.js server processes spawning shells or LOLBins (post-RCE behavior)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId, ProcessId
| order by TimeGenerated desc;

// Hunt 2: Path traversal patterns in IIS / web server logs ingested via W3CIISLog or CEF
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("..%5c", "..%255c", "..%2f", "..%252f", "%2e%2e", "..\\", "..;/")
   or csUriQuery has_any ("..%5c", "..%255c", "..%2f", "..%252f", "%2e%2e", "..\\")
| project TimeGenerated, Computer, sIP, cIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent
| order by TimeGenerated desc;

// Hunt 3: Traversal strings in Syslog/CEF forwarded web or app logs (Linux-hosted Next.js)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("..%5c", "..%255c", "..%2f", "%2e%2e", "..;/")
    and RequestURL has_any ("/_next/", "/api/")
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceAction
| order by TimeGenerated desc;

-- Hunt for Node.js server processes that have spawned shells or suspicious children,
-- indicative of post-exploitation following Next.js RCE (CVE-2026-75604 / AVIF flaw)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin)\.exe'
  AND Ppid IN (
      SELECT Pid FROM pslist() WHERE Name =~ '(?i)node(\.exe)?$'
  )

-- Hunt for staged AVIF payloads in temp and web-writable directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Windows/Temp/**/*.avif',
  'C:/Users/*/AppData/Local/Temp/**/*.avif',
  'C:/inetpub/**/*.avif',
  'C:/**/uploads/**/*.avif'
])
ORDER BY Mtime DESC

# Verify Next.js version exposure and confirm patch status on Windows hosts
# Run on each Windows server hosting a self-hosted Next.js application

$ErrorActionPreference = 'SilentlyContinue'

# 1. Locate installed Next.js versions across common deployment paths
$searchPaths = @('C:\inetpub', 'C:\apps', 'C:\srv', 'C:\home', 'D:\')
$found = @()
foreach ($base in $searchPaths) {
    if (Test-Path $base) {
        $found += Get-ChildItem -Path $base -Recurse -Filter 'package.json' -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -notmatch 'node_modules' }
    }
}

foreach ($pkg in $found) {
    $json = Get-Content $pkg.FullName -Raw | ConvertFrom-Json
    $nextVer = $json.dependencies.next
    if (-not $nextVer) { $nextVer = $json.devDependencies.next }
    if ($nextVer) {
        Write-Host "[FOUND] $($pkg.FullName) -> next: $nextVer" -ForegroundColor Yellow
    }
}

# 2. Check globally and locally installed next packages
Write-Host "`n[GLOBAL] npm ls -g next:" -ForegroundColor Cyan
npm ls -g next 2>$null

# 3. Audit each project directory for the vulnerable package
foreach ($pkg in $found) {
    $dir = Split-Path $pkg.FullName -Parent
    if (Test-Path (Join-Path $dir 'node_modules\next\package.json')) {
        $installed = (Get-Content (Join-Path $dir 'node_modules\next\package.json') -Raw | ConvertFrom-Json).version
        Write-Host "[INSTALLED] $dir -> next@$installed" -ForegroundColor Cyan
        Write-Host "  ACTION: Compare against Vercel's patched versions at https://github.com/vercel/next.js/security/advisories" -ForegroundColor Magenta
        Write-Host "  PATCH:  cd '$dir'; npm install next@latest; npm audit" -ForegroundColor Green
    }
}

# 4. Hunt IIS logs from the last 72 hours for traversal probes (CVE-2026-75604)
$cutoff = (Get-Date).AddDays(-3)
$logDirs = @('C:\inetpub\logs\LogFiles')
foreach ($logDir in $logDirs) {
    if (Test-Path $logDir) {
        Get-ChildItem $logDir -Recurse -Filter '*.log' |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-String -Pattern '(\.\.%5c|\.\.%255c|\.\.%2f|%2e%2e|\.\.\\|\.\.;/)' -AllMatches |
            ForEach-Object {
                Write-Host "[ALERT] $($_.Path):$($_.LineNumber) :: $($_.Line.Trim())" -ForegroundColor Red
            }
    }
}

Write-Host "`n[DONE] Review all [FOUND]/[INSTALLED] entries and upgrade to the patched Next.js release immediately." -ForegroundColor Green