Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676
ResearchNettyNext.jsOur summary
Ox Security has released a detailed technical breakdown of recent vulnerabilities affecting Netty, Next.js, and GitPython. The report examines the root causes behind CVE-2026-75595 in Netty's TLS handling, CVE-2026-75604 involving Windows-specific path traversal in Next.js, and CVE-2026-78676 in GitPython's configuration writer.
Additionally, the analysis covers GHSA-2xp9-vwfh-vxw4, an issue in Next.js related to unprocessed AVIF files triggering heap corruption via libheif. While these flaws have been addressed in updated releases, the article highlights critical gaps in defensive coding, such as incomplete bounds checks and inconsistent serialization logic that allowed the exploits to succeed.
Below is the opening; the full story is at OX Security.
From OX Security
In this blog we’re breaking down each CVE separately, including the root cause, technical overview and patch details.
Read our analysis of these 4 critical CVEs
Root Cause
A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.