Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

published 2026-08-25 2 mo ago modified 2026-09-08 2 mo ago

cvss: 9.5; version 4.0, the maintainers
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

Patch / fix

fixed in 1 links 7

npm next 15.5.24, 16.3.3

github.com/vercel/next.js@3a15b4a commit
github.com/vercel/next.js@409772e commit
github.com/vercel/next.js@7a5937a commit
github.com/vercel/next.js#97875 pull request
github.com/vercel/next.js#97931 pull request
github.com/vercel/next.js/releases/tag/v15.5.24 release
github.com/vercel/next.js/releases/tag/v16.3.3 release

CVSS scores

assigned by	version	score	vector
the maintainers	4.0	9.5	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected packages

ecosystem	package	affected	fixed in
npm	next	>=10.0.0, <15.5.24 >=16.0.0, <16.3.3	15.5.24 16.3.3

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component

Technology feeds

Next.js rss critical rss

References

Sources

GitHub Advisory GHSA-2xp9-vwfh-vxw4
Maintainer advisory GHSA-2xp9-vwfh-vxw4

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of vercel/next.js published their own advisory on GitHub. Reviewed sources take precedence over it.

Summary